File Selector Crashes Showing Thumbnails #74609

New Issue

Campbell Barton · 2020-03-10T09:27:37+01:00

Campbell Barton commented

2020-03-10 09:27:37 +01:00

This bug is difficult to redo, however I've run into it a few times when testing the sequencer, which happens to have the file-selector open.

There is a double free in the file-selector code.

Open the Video Editor template.
Navigate the file selector to a directory containing images (only ~8 in my case).
Add sequence strips, drag them around, undo, redo... duplicate.
Eventually I get crash with Asan that reports a double-free.

=================================================================
==49913==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000b9d188 at pc 0x5564099caacf bp 0x7f6538c54450 sp 0x7f6538c54440
READ of size 4 at 0x619000b9d188 thread T14
    - 0 0x5564099caace in filelist_cache_preview_freef /src/blender/source/blender/editors/space_file/filelist.c:1299
    - 1 0x55640a359cd2 in task_data_free /src/blender/source/blender/blenlib/intern/task.c:235
    - 2 0x55640a359cd2 in task_free /src/blender/source/blender/blenlib/intern/task.c:301
    - 3 0x55640a35c509 in task_scheduler_thread_run /src/blender/source/blender/blenlib/intern/task.c:454
    - 4 0x7f655c70146e in start_thread (/usr/lib/libpthread.so.0+0x946e)
    - 5 0x7f655af973d2 in clone (/usr/lib/libc.so.6+0xff3d2)

0x619000b9d188 is located 1032 bytes inside of 1048-byte region [0x619000b9cd80,0x619000b9d198)
freed by thread T0 here:
    - 0 0x7f655cb28720 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
    - 1 0x55640a390b84 in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:157
    - 2 0x5564099d4de9 in filelist_cache_previews_update /src/blender/source/blender/editors/space_file/filelist.c:2140
    - 3 0x55640999c63b in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:732
    - 4 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504
    - 5 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534
    - 6 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640
    - 7 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776
    - 8 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958
    - 9 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448
    - 10 0x556403848bae in main /src/blender/source/creator/creator.c:522
    - 11 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

previously allocated by thread T0 here:
    - 0 0x7f655cb28b3a in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:144
    - 1 0x55640a391697 in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:308
    - 2 0x5564099cb77f in filelist_cache_previews_push /src/blender/source/blender/editors/space_file/filelist.c:1364
    - 3 0x5564099d42e1 in filelist_file_cache_block /src/blender/source/blender/editors/space_file/filelist.c:2059
    - 4 0x55640999c567 in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:727
    - 5 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504
    - 6 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534
    - 7 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640
    - 8 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776
    - 9 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958
    - 10 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448
    - 11 0x556403848bae in main /src/blender/source/creator/creator.c:522
    #12 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

Thread T14 created by T0 here:
    - 0 0x7f655ca52377 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:208
    - 1 0x55640a35d83d in BLI_task_scheduler_create /src/blender/source/blender/blenlib/intern/task.c:517
    - 2 0x55640a3724bf in BLI_task_scheduler_get /src/blender/source/blender/blenlib/intern/threads.c:177
    - 3 0x55640a369e93 in BLI_task_parallel_range /src/blender/source/blender/blenlib/intern/task.c:1316
    - 4 0x5564088935af in flush_prepare /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:113
    - 5 0x5564088935af in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:353
    - 6 0x556408745822 in DEG_evaluate_on_refresh /src/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:63
    - 7 0x556403f43623 in scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1314
    - 8 0x556403f4373c in BKE_scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1353
    - 9 0x55640463ae5f in wm_event_do_depsgraph /src/blender/source/blender/windowmanager/intern/wm_event_system.c:359
    - 10 0x556404677e37 in wm_file_read_post /src/blender/source/blender/windowmanager/intern/wm_files.c:557
    - 11 0x55640467acf0 in wm_homefile_read /src/blender/source/blender/windowmanager/intern/wm_files.c:1067
    - 12 0x55640469ef3e in WM_init /src/blender/source/blender/windowmanager/intern/wm_init_exit.c:292
    - 13 0x5564038489dd in main /src/blender/source/creator/creator.c:443
    #14 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/editors/space_file/filelist.c:1299 in filelist_cache_preview_freef
Shadow bytes around the buggy address:
  0x0c328016b9e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016b9f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c328016ba30: fd[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

asan_filesel.txt

The asan report is fairly clear, uploading this in case it helps resolve the issue.

If this issue isn't helpful to keep open (as its difficult to redo) can be closed too.

This bug is difficult to redo, however I've run into it a few times when testing the sequencer, which happens to have the file-selector open. There is a double free in the file-selector code. - Open the Video Editor template. - Navigate the file selector to a directory containing images (only ~8 in my case). - Add sequence strips, drag them around, undo, redo... duplicate. - Eventually I get crash with Asan that reports a double-free. ```lines=20 ================================================================= ==49913==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000b9d188 at pc 0x5564099caacf bp 0x7f6538c54450 sp 0x7f6538c54440 READ of size 4 at 0x619000b9d188 thread T14 - 0 0x5564099caace in filelist_cache_preview_freef /src/blender/source/blender/editors/space_file/filelist.c:1299 - 1 0x55640a359cd2 in task_data_free /src/blender/source/blender/blenlib/intern/task.c:235 - 2 0x55640a359cd2 in task_free /src/blender/source/blender/blenlib/intern/task.c:301 - 3 0x55640a35c509 in task_scheduler_thread_run /src/blender/source/blender/blenlib/intern/task.c:454 - 4 0x7f655c70146e in start_thread (/usr/lib/libpthread.so.0+0x946e) - 5 0x7f655af973d2 in clone (/usr/lib/libc.so.6+0xff3d2) 0x619000b9d188 is located 1032 bytes inside of 1048-byte region [0x619000b9cd80,0x619000b9d198) freed by thread T0 here: - 0 0x7f655cb28720 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 - 1 0x55640a390b84 in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:157 - 2 0x5564099d4de9 in filelist_cache_previews_update /src/blender/source/blender/editors/space_file/filelist.c:2140 - 3 0x55640999c63b in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:732 - 4 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504 - 5 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534 - 6 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640 - 7 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776 - 8 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958 - 9 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448 - 10 0x556403848bae in main /src/blender/source/creator/creator.c:522 - 11 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022) previously allocated by thread T0 here: - 0 0x7f655cb28b3a in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:144 - 1 0x55640a391697 in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:308 - 2 0x5564099cb77f in filelist_cache_previews_push /src/blender/source/blender/editors/space_file/filelist.c:1364 - 3 0x5564099d42e1 in filelist_file_cache_block /src/blender/source/blender/editors/space_file/filelist.c:2059 - 4 0x55640999c567 in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:727 - 5 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504 - 6 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534 - 7 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640 - 8 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776 - 9 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958 - 10 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448 - 11 0x556403848bae in main /src/blender/source/creator/creator.c:522 #12 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022) Thread T14 created by T0 here: - 0 0x7f655ca52377 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:208 - 1 0x55640a35d83d in BLI_task_scheduler_create /src/blender/source/blender/blenlib/intern/task.c:517 - 2 0x55640a3724bf in BLI_task_scheduler_get /src/blender/source/blender/blenlib/intern/threads.c:177 - 3 0x55640a369e93 in BLI_task_parallel_range /src/blender/source/blender/blenlib/intern/task.c:1316 - 4 0x5564088935af in flush_prepare /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:113 - 5 0x5564088935af in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:353 - 6 0x556408745822 in DEG_evaluate_on_refresh /src/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:63 - 7 0x556403f43623 in scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1314 - 8 0x556403f4373c in BKE_scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1353 - 9 0x55640463ae5f in wm_event_do_depsgraph /src/blender/source/blender/windowmanager/intern/wm_event_system.c:359 - 10 0x556404677e37 in wm_file_read_post /src/blender/source/blender/windowmanager/intern/wm_files.c:557 - 11 0x55640467acf0 in wm_homefile_read /src/blender/source/blender/windowmanager/intern/wm_files.c:1067 - 12 0x55640469ef3e in WM_init /src/blender/source/blender/windowmanager/intern/wm_init_exit.c:292 - 13 0x5564038489dd in main /src/blender/source/creator/creator.c:443 #14 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022) SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/editors/space_file/filelist.c:1299 in filelist_cache_preview_freef Shadow bytes around the buggy address: 0x0c328016b9e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c328016b9f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c328016ba00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c328016ba10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c328016ba20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c328016ba30: fd[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c328016ba40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c328016ba50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c328016ba60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c328016ba70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c328016ba80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ``` [asan_filesel.txt](https://archive.blender.org/developer/F8398682/asan_filesel.txt) The asan report is fairly clear, uploading this in case it helps resolve the issue. If this issue isn't helpful to keep open (as its difficult to redo) can be closed too.

Bastien Montagne was assigned by Campbell Barton

2020-03-10 09:27:37 +01:00

Campbell Barton commented

2020-03-10 09:27:37 +01:00

Added subscriber: @ideasman42

Bastien Montagne commented

2020-03-10 09:36:41 +01:00

Changed status from 'Needs Triage' to: 'Needs Developer To Reproduce'

Philipp Oeser commented

2020-03-10 14:37:12 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2020-03-10 14:37:12 +01:00

@ideasman42 : havent checked, but can you still repro since {85cdf9a1b9}?

Bastien Montagne commented

2020-03-13 14:29:43 +01:00

Tried to reproduce here with debug ASAN build, with no luck, not a single crash...

However, from the ASAN backtrace I think I understand what is going on here - some super unlikely concurrent situation indeed could lead to accessing freed memory, am preparing a fix for that, and hopefully you'll be able to confirm it works then.

Tried to reproduce here with debug ASAN build, with no luck, not a single crash... However, from the ASAN backtrace I think I understand what is going on here - some super unlikely concurrent situation indeed could lead to accessing freed memory, am preparing a fix for that, and hopefully you'll be able to confirm it works then.

Bastien Montagne commented

2020-03-13 15:29:10 +01:00

Changed status from 'Needs Developer To Reproduce' to: 'Needs User Info'

Bastien Montagne commented

2020-03-20 18:32:58 +01:00

Changed status from 'Needs User Info' to: 'Resolved'

Bastien Montagne closed this issue

2020-03-20 18:32:58 +01:00

Bastien Montagne commented

2020-03-20 18:32:58 +01:00

No news for a week, so assuming this has been fixed for now.

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

File Selector Crashes Showing Thumbnails #74609