Segfault in parent_set_exec with type=BONE #94441

New Issue

Andrew Oates · 2021-12-28T17:16:55+01:00

Andrew Oates commented

2021-12-28 17:16:55 +01:00

System Information
Operating system: macOS-10.13.6-x86_64-i386-64bit 64 Bits
Graphics card: NVIDIA GeForce GT 750M OpenGL Engine NVIDIA Corporation 4.1 NVIDIA-10.32.0 355.11.10.10.40.102

Blender Version
Broken: version: 3.1.0 Alpha, branch: master, commit date: 2021-12-27 21:23, hash: 8c4edd1b37
Worked: unknown

*Short description of error
When calling the bpy.ops.object.parent_set(type='BONE') with a newly-created bone from a python script, Blender segfaults. If I set the active editbone to the newly created bone earlier in the script, no segfault.

Exact steps for others to reproduce the error

open attached .blend file
run the open script with Option-P

Console output, including stack trace:

> # Blender 3.1.0, Commit date: 2021-12-27 21:23, Hash 8c4edd1b379d
> bpy.ops.object.editmode_toggle()  # Operator
> bpy.ops.object.posemode_toggle()  # Operator
> 
> # backtrace
> 0   Blender                             0x0000000115a19e27 BLI_system_backtrace + 55
> 1   Blender                             0x000000010b9ab1e8 sig_handle_crash + 392
> 2   libsystem_platform.dylib            0x00007fff504b0f5a _sigtramp + 26
> 3   ???                                 0x00007f93a2c43a08 0x0 + 140272067688968
> 4   Blender                             0x000000010c9800eb parent_set_exec + 347
> 5   Blender                             0x000000010bf71211 wm_operator_invoke + 417
> 6   Blender                             0x000000010bf6b288 wm_operator_call_internal + 312
> 7   Blender                             0x000000010bf6b97e WM_operator_call_py + 94
> 8   Blender                             0x000000010c51f114 pyop_call + 772
> 9   Blender                             0x00000001142e5832 cfunction_call + 130
> 10  Blender                             0x00000001142a1977 _PyObject_MakeTpCall + 375
> 11  Blender                             0x0000000114393228 call_function + 776
> 12  Blender                             0x000000011438fa82 _PyEval_EvalFrameDefault + 26946
> 13  Blender                             0x00000001143941bd _PyEval_EvalCode + 3245
> 14  Blender                             0x00000001142a2111 _PyFunction_Vectorcall + 257
> 15  Blender                             0x00000001142a173d _PyObject_FastCallDictTstate + 173
> 16  Blender                             0x00000001142a24db _PyObject_Call_Prepend + 139
> 17  Blender                             0x00000001143041eb slot_tp_call + 203
> 18  Blender                             0x00000001142a1977 _PyObject_MakeTpCall + 375
> 19  Blender                             0x0000000114393228 call_function + 776
> 20  Blender                             0x000000011438fb2a _PyEval_EvalFrameDefault + 27114
> 21  Blender                             0x00000001143941bd _PyEval_EvalCode + 3245
> 22  Blender                             0x0000000114389070 PyEval_EvalCode + 64
> 23  Blender                             0x0{F12779437}00000010c51d073 python_script_exec + 579
> 24  Blender                             0x000000010cc0c830 text_run_script + 64
> 25  Blender                             0x000000010bf71211 wm_operator_invoke + 417
> 26  Blender                             0x000000010bf72c48 wm_handler_operator_call + 648
> 27  Blender                             0x000000010bf720ed wm_handlers_do_intern + 2317
> 28  Blender                             0x000000010bf6d544 wm_handlers_do + 52
> 29  Blender                             0x000000010bf6cece wm_event_do_handlers + 2910
> 30  Blender                             0x000000010bf64a20 WM_main + 32
> 31  Blender                             0x000000010b9a79e6 main + 902
> 32  libdyld.dylib                       0x00007fff501a2015 start + 1
> 
> # Python backtrace
>   File "/Volumes/Blender/Blender.app/Contents/Resources/3.1/scripts/modules/bpy/ops.py", line 132 in __call__
>   File "XXX/{F12779436}wing_test_crashes.blend/Text", line 41 in <module>
> 
>

wing_test_crashes.blend

**System Information** Operating system: macOS-10.13.6-x86_64-i386-64bit 64 Bits Graphics card: NVIDIA GeForce GT 750M OpenGL Engine NVIDIA Corporation 4.1 NVIDIA-10.32.0 355.11.10.10.40.102 **Blender Version** Broken: version: 3.1.0 Alpha, branch: master, commit date: 2021-12-27 21:23, hash: `8c4edd1b37` Worked: unknown **Short description of error* When calling the bpy.ops.object.parent_set(type='BONE') with a newly-created bone from a python script, Blender segfaults. If I set the active editbone to the newly created bone earlier in the script, no segfault. **Exact steps for others to reproduce the error** 1) open attached .blend file 2) run the open script with Option-P Console output, including stack trace: ```lines=10 > # Blender 3.1.0, Commit date: 2021-12-27 21:23, Hash 8c4edd1b379d > bpy.ops.object.editmode_toggle() # Operator > bpy.ops.object.posemode_toggle() # Operator > > # backtrace > 0 Blender 0x0000000115a19e27 BLI_system_backtrace + 55 > 1 Blender 0x000000010b9ab1e8 sig_handle_crash + 392 > 2 libsystem_platform.dylib 0x00007fff504b0f5a _sigtramp + 26 > 3 ??? 0x00007f93a2c43a08 0x0 + 140272067688968 > 4 Blender 0x000000010c9800eb parent_set_exec + 347 > 5 Blender 0x000000010bf71211 wm_operator_invoke + 417 > 6 Blender 0x000000010bf6b288 wm_operator_call_internal + 312 > 7 Blender 0x000000010bf6b97e WM_operator_call_py + 94 > 8 Blender 0x000000010c51f114 pyop_call + 772 > 9 Blender 0x00000001142e5832 cfunction_call + 130 > 10 Blender 0x00000001142a1977 _PyObject_MakeTpCall + 375 > 11 Blender 0x0000000114393228 call_function + 776 > 12 Blender 0x000000011438fa82 _PyEval_EvalFrameDefault + 26946 > 13 Blender 0x00000001143941bd _PyEval_EvalCode + 3245 > 14 Blender 0x00000001142a2111 _PyFunction_Vectorcall + 257 > 15 Blender 0x00000001142a173d _PyObject_FastCallDictTstate + 173 > 16 Blender 0x00000001142a24db _PyObject_Call_Prepend + 139 > 17 Blender 0x00000001143041eb slot_tp_call + 203 > 18 Blender 0x00000001142a1977 _PyObject_MakeTpCall + 375 > 19 Blender 0x0000000114393228 call_function + 776 > 20 Blender 0x000000011438fb2a _PyEval_EvalFrameDefault + 27114 > 21 Blender 0x00000001143941bd _PyEval_EvalCode + 3245 > 22 Blender 0x0000000114389070 PyEval_EvalCode + 64 > 23 Blender 0x0{F12779437}00000010c51d073 python_script_exec + 579 > 24 Blender 0x000000010cc0c830 text_run_script + 64 > 25 Blender 0x000000010bf71211 wm_operator_invoke + 417 > 26 Blender 0x000000010bf72c48 wm_handler_operator_call + 648 > 27 Blender 0x000000010bf720ed wm_handlers_do_intern + 2317 > 28 Blender 0x000000010bf6d544 wm_handlers_do + 52 > 29 Blender 0x000000010bf6cece wm_event_do_handlers + 2910 > 30 Blender 0x000000010bf64a20 WM_main + 32 > 31 Blender 0x000000010b9a79e6 main + 902 > 32 libdyld.dylib 0x00007fff501a2015 start + 1 > > # Python backtrace > File "/Volumes/Blender/Blender.app/Contents/Resources/3.1/scripts/modules/bpy/ops.py", line 132 in __call__ > File "XXX/{F12779436}wing_test_crashes.blend/Text", line 41 in <module> > > ``` [wing_test_crashes.blend](https://archive.blender.org/developer/F12779439/wing_test_crashes.blend)

Andrew Oates commented

2021-12-28 17:16:55 +01:00

Added subscriber: @aoates

Pratik Borhade commented

2021-12-29 10:59:14 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Pratik Borhade commented

2021-12-29 10:59:19 +01:00

Added subscriber: @PratikPB2123

Andrew Oates commented

2022-09-26 19:51:17 +02:00

Here is the most minimal repro steps I've been able to come up with. Note that it is very sensitive to the order of operations, and I don't totally understand what is going on under the hood.

New default scene
Scripting tab, create new script, paste the script below in
Add an armature
Go to edit mode
Select all bones with 'A', delete with 'X'
Run script

Script:

import bpy
import mathutils

arm = bpy.data.objects['Armature']
obj = bpy.data.objects['Cube']

eb = arm.data.edit_bones

name = 'TestBone'
assert(name not in arm.data.bones)
b = eb.new(name)
b.head = obj.location
b.tail = obj.location + mathutils.Vector((0, 0, 1))

bpy.ops.object.mode_set(mode='POSE')
obj.select_set(True)
pose_bone = arm.data.bones[name]
arm.data.bones.active = pose_bone

#b.select = True  # Prevents crash
bpy.ops.object.parent_set(type='BONE')

The above steps reliably crash on multiple different builds for me (including from HEAD) with pchan_eval being NULL. If you don't delete the existing bones first, the crash doesn't happen --- I don't know why. There are other paths to get into this state, but this is the reliable repro I've found.

Here is the most minimal repro steps I've been able to come up with. Note that it is very sensitive to the order of operations, and I don't totally understand what is going on under the hood. 1) New default scene 2) Scripting tab, create new script, paste the script below in 3) Add an armature 4) Go to edit mode 5) Select all bones with 'A', delete with 'X' 6) Run script Script: ``` import bpy import mathutils arm = bpy.data.objects['Armature'] obj = bpy.data.objects['Cube'] eb = arm.data.edit_bones name = 'TestBone' assert(name not in arm.data.bones) b = eb.new(name) b.head = obj.location b.tail = obj.location + mathutils.Vector((0, 0, 1)) bpy.ops.object.mode_set(mode='POSE') obj.select_set(True) pose_bone = arm.data.bones[name] arm.data.bones.active = pose_bone #b.select = True # Prevents crash bpy.ops.object.parent_set(type='BONE') ``` The above steps reliably crash on multiple different builds for me (including from HEAD) with `pchan_eval` being NULL. If you don't delete the existing bones first, the crash doesn't happen --- I don't know why. There are other paths to get into this state, but this is the reliable repro I've found.

Andrew Oates commented

2022-09-28 17:58:03 +02:00

For completeness, here is a standalone script that repros the bug without needing any other steps:

import bpy
import mathutils

bpy.ops.mesh.primitive_cube_add()
obj = bpy.context.selected_objects[0]
bpy.ops.object.armature_add()
arm = bpy.context.selected_objects[0]

bpy.ops.object.mode_set(mode='EDIT')
arm.data.edit_bones[0].select = True
bpy.ops.armature.delete()

eb = arm.data.edit_bones

name = 'TestBone'
assert(name not in arm.data.bones)
b = eb.new(name)
b.head = obj.location
b.tail = obj.location + mathutils.Vector((0, 0, 1))

assert(bpy.context.selected_editable_bones == [])

bpy.ops.object.mode_set(mode='POSE')
obj.select_set(True)
pose_bone = arm.data.bones[name]
arm.data.bones.active = pose_bone
bpy.ops.object.parent_set(type='BONE')

For completeness, here is a standalone script that repros the bug without needing any other steps: ``` import bpy import mathutils bpy.ops.mesh.primitive_cube_add() obj = bpy.context.selected_objects[0] bpy.ops.object.armature_add() arm = bpy.context.selected_objects[0] bpy.ops.object.mode_set(mode='EDIT') arm.data.edit_bones[0].select = True bpy.ops.armature.delete() eb = arm.data.edit_bones name = 'TestBone' assert(name not in arm.data.bones) b = eb.new(name) b.head = obj.location b.tail = obj.location + mathutils.Vector((0, 0, 1)) assert(bpy.context.selected_editable_bones == []) bpy.ops.object.mode_set(mode='POSE') obj.select_set(True) pose_bone = arm.data.bones[name] arm.data.bones.active = pose_bone bpy.ops.object.parent_set(type='BONE') ```

blender-admin commented

2022-09-29 10:17:22 +02:00

This issue was referenced by 4bdba62cb9

This issue was referenced by 4bdba62cb94978c94d29150d2fd426ca18aa8d0d

Sergey Sharybin commented

2022-09-29 10:35:39 +02:00

Changed status from 'Confirmed' to: 'Resolved'

Sergey Sharybin closed this issue

2022-09-29 10:35:39 +02:00

Sergey Sharybin self-assigned this 2022-09-29 10:35:39 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Segfault in parent_set_exec with type=BONE #94441