Crash when getting out of EditMode in some cases. #55380

New Issue

Bastien Montagne · 2018-06-07T18:18:37+02:00

Bastien Montagne commented

2018-06-07 18:18:37 +02:00

Switching out of EditMode crashes sometimes, probably because conversion from BMesh to Mesh frees all existing data in current object's mesh, and some code tries to access that (shallow-copied) data from evaluated mesh?

To reproduce:

open mesh_editmode_to_sculpt_crash.blend
switch to Sculpt mode
switch to Edit mode
Change topology by adding some items (e.g. W->Subdivide)

switch back to Sculpt mode

Crashes on 'use-after-free' error:

=================================================================
==25943==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0012f4078 at pc 0x7fe068a348a3 bp 0x7ffde6af36f0 sp 0x7ffde6af2ea0
READ of size 12 at 0x60b0012f4078 thread T0
    - 0 0x7fe068a348a2  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xab8a2)
    - 1 0x55d087c0b64c in BKE_pbvh_apply_vertCos /home/guest/blender/blender/source/blender/blenkernel/intern/pbvh.c:2212
    - 2 0x55d0877b9bbc in cdDM_getPBVH /home/guest/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:328
    - 3 0x55d087b8b357 in BKE_sculpt_update_mesh_elements /home/guest/blender/blender/source/blender/blenkernel/intern/paint.c:934
    - 4 0x55d086552e35 in sculpt_init_session /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5632
    - 5 0x55d08655302a in ED_object_sculptmode_enter_ex /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5668
    - 6 0x55d086553a16 in sculpt_mode_toggle_exec /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5825
    - 7 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285
    - 8 0x55d08557f429 in wm_operator_call_internal /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1470
    - 9 0x55d08557f6ac in WM_operator_name_call_ptr /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1518
    - 10 0x55d08557f6fc in WM_operator_name_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1524
    - 11 0x55d086241be6 in ED_object_mode_toggle /home/guest/blender/blender/source/blender/editors/object/object_modes.c:151
    - 12 0x55d08623ee36 in object_mode_set_exec /home/guest/blender/blender/source/blender/editors/object/object_edit.c:1419
    - 13 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285
    - 14 0x55d0855824e0 in wm_handler_operator_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1989
    - 15 0x55d085583ee9 in wm_handlers_do_intern /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2274
    - 16 0x55d0855857bb in wm_handlers_do /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2523
    - 17 0x55d0855886d6 in wm_event_do_handlers /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2943
    - 18 0x55d0855656f3 in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:546
    - 19 0x55d08555a96e in main /home/guest/blender/blender/source/creator/creator.c:516
    - 20 0x7fe060d04a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)
    - 21 0x55d085559d79 in _start (/home/guest/blender/build_2.8_debug/bin/blender+0x332ed79)

0x60b0012f4078 is located 0 bytes to the right of 104-byte region [0x60b0012f4010,0x60b0012f4078)
allocated by thread T0 here:
    - 0 0x7fe068a62c20 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9c20)
    - 1 0x55d088ae19d5 in MEM_lockfree_mallocN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:318
    - 2 0x55d088ae1c9a in MEM_lockfree_malloc_arrayN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:349
    - 3 0x55d0877b9b35 in cdDM_getPBVH /home/guest/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:326
    - 4 0x55d087b8b357 in BKE_sculpt_update_mesh_elements /home/guest/blender/blender/source/blender/blenkernel/intern/paint.c:934
    - 5 0x55d086552e35 in sculpt_init_session /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5632
    - 6 0x55d08655302a in ED_object_sculptmode_enter_ex /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5668
    - 7 0x55d086553a16 in sculpt_mode_toggle_exec /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5825
    - 8 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285
    - 9 0x55d08557f429 in wm_operator_call_internal /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1470
    - 10 0x55d08557f6ac in WM_operator_name_call_ptr /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1518
    - 11 0x55d08557f6fc in WM_operator_name_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1524
    - 12 0x55d086241be6 in ED_object_mode_toggle /home/guest/blender/blender/source/blender/editors/object/object_modes.c:151
    - 13 0x55d08623ee36 in object_mode_set_exec /home/guest/blender/blender/source/blender/editors/object/object_edit.c:1419
    - 14 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285
    - 15 0x55d0855824e0 in wm_handler_operator_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1989
    - 16 0x55d085583ee9 in wm_handlers_do_intern /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2274
    - 17 0x55d0855857bb in wm_handlers_do /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2523
    - 18 0x55d0855886d6 in wm_event_do_handlers /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2943
    - 19 0x55d0855656f3 in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:546
    - 20 0x55d08555a96e in main /home/guest/blender/blender/source/creator/creator.c:516
    - 21 0x7fe060d04a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)

SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xab8a2) 
Shadow bytes around the buggy address:
  0x0c16802567b0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa
  0x0c16802567c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa
  0x0c16802567d0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
  0x0c16802567e0: fd fd fd fd fa fa fa fa fa fa fa fa 00 00 00 00
  0x0c16802567f0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa
=>0x0c1680256800: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00[fa]
  0x0c1680256810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1680256820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1680256830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1680256840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c1680256850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==25943==ABORTING

Switching out of EditMode crashes sometimes, *probably* because conversion from BMesh to Mesh frees all existing data in current object's mesh, and some code tries to access that (shallow-copied) data from evaluated mesh? To reproduce: - open [mesh_editmode_to_sculpt_crash.blend](https://archive.blender.org/developer/F3618477/mesh_editmode_to_sculpt_crash.blend) - switch to Sculpt mode - switch to Edit mode - Change topology by adding some items (e.g. W->Subdivide) # switch back to Sculpt mode Crashes on 'use-after-free' error: ``` ================================================================= ==25943==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60b0012f4078 at pc 0x7fe068a348a3 bp 0x7ffde6af36f0 sp 0x7ffde6af2ea0 READ of size 12 at 0x60b0012f4078 thread T0 - 0 0x7fe068a348a2 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xab8a2) - 1 0x55d087c0b64c in BKE_pbvh_apply_vertCos /home/guest/blender/blender/source/blender/blenkernel/intern/pbvh.c:2212 - 2 0x55d0877b9bbc in cdDM_getPBVH /home/guest/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:328 - 3 0x55d087b8b357 in BKE_sculpt_update_mesh_elements /home/guest/blender/blender/source/blender/blenkernel/intern/paint.c:934 - 4 0x55d086552e35 in sculpt_init_session /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5632 - 5 0x55d08655302a in ED_object_sculptmode_enter_ex /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5668 - 6 0x55d086553a16 in sculpt_mode_toggle_exec /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5825 - 7 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285 - 8 0x55d08557f429 in wm_operator_call_internal /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1470 - 9 0x55d08557f6ac in WM_operator_name_call_ptr /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1518 - 10 0x55d08557f6fc in WM_operator_name_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1524 - 11 0x55d086241be6 in ED_object_mode_toggle /home/guest/blender/blender/source/blender/editors/object/object_modes.c:151 - 12 0x55d08623ee36 in object_mode_set_exec /home/guest/blender/blender/source/blender/editors/object/object_edit.c:1419 - 13 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285 - 14 0x55d0855824e0 in wm_handler_operator_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1989 - 15 0x55d085583ee9 in wm_handlers_do_intern /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2274 - 16 0x55d0855857bb in wm_handlers_do /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2523 - 17 0x55d0855886d6 in wm_event_do_handlers /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2943 - 18 0x55d0855656f3 in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:546 - 19 0x55d08555a96e in main /home/guest/blender/blender/source/creator/creator.c:516 - 20 0x7fe060d04a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) - 21 0x55d085559d79 in _start (/home/guest/blender/build_2.8_debug/bin/blender+0x332ed79) 0x60b0012f4078 is located 0 bytes to the right of 104-byte region [0x60b0012f4010,0x60b0012f4078) allocated by thread T0 here: - 0 0x7fe068a62c20 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9c20) - 1 0x55d088ae19d5 in MEM_lockfree_mallocN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:318 - 2 0x55d088ae1c9a in MEM_lockfree_malloc_arrayN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:349 - 3 0x55d0877b9b35 in cdDM_getPBVH /home/guest/blender/blender/source/blender/blenkernel/intern/cdderivedmesh.c:326 - 4 0x55d087b8b357 in BKE_sculpt_update_mesh_elements /home/guest/blender/blender/source/blender/blenkernel/intern/paint.c:934 - 5 0x55d086552e35 in sculpt_init_session /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5632 - 6 0x55d08655302a in ED_object_sculptmode_enter_ex /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5668 - 7 0x55d086553a16 in sculpt_mode_toggle_exec /home/guest/blender/blender/source/blender/editors/sculpt_paint/sculpt.c:5825 - 8 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285 - 9 0x55d08557f429 in wm_operator_call_internal /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1470 - 10 0x55d08557f6ac in WM_operator_name_call_ptr /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1518 - 11 0x55d08557f6fc in WM_operator_name_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1524 - 12 0x55d086241be6 in ED_object_mode_toggle /home/guest/blender/blender/source/blender/editors/object/object_modes.c:151 - 13 0x55d08623ee36 in object_mode_set_exec /home/guest/blender/blender/source/blender/editors/object/object_edit.c:1419 - 14 0x55d08557e45c in wm_operator_invoke /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1285 - 15 0x55d0855824e0 in wm_handler_operator_call /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:1989 - 16 0x55d085583ee9 in wm_handlers_do_intern /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2274 - 17 0x55d0855857bb in wm_handlers_do /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2523 - 18 0x55d0855886d6 in wm_event_do_handlers /home/guest/blender/blender/source/blender/windowmanager/intern/wm_event_system.c:2943 - 19 0x55d0855656f3 in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:546 - 20 0x55d08555a96e in main /home/guest/blender/blender/source/creator/creator.c:516 - 21 0x7fe060d04a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86) SUMMARY: AddressSanitizer: heap-buffer-overflow (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xab8a2) Shadow bytes around the buggy address: 0x0c16802567b0: fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa 0x0c16802567c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa 0x0c16802567d0: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd 0x0c16802567e0: fd fd fd fd fa fa fa fa fa fa fa fa 00 00 00 00 0x0c16802567f0: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa =>0x0c1680256800: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00[fa] 0x0c1680256810: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1680256820: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1680256830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1680256840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1680256850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==25943==ABORTING ```

Sergey Sharybin was assigned by Bastien Montagne

2018-06-07 18:18:37 +02:00

Bastien Montagne commented

2018-06-07 18:18:37 +02:00

Added subscriber: @mont29

blender-admin commented

2018-06-08 14:36:26 +02:00

This issue was referenced by ae3e59fb61

This issue was referenced by ae3e59fb6181cf1e2ca0788dbec638270aac6c23

Sergey Sharybin commented

2018-06-08 14:38:11 +02:00

Changed status from 'Open' to: 'Resolved'

Sergey Sharybin closed this issue

2018-06-08 14:38:11 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when getting out of EditMode in some cases. #55380

switch back to Sculpt mode