Blender instantly closes when clicking on the "Key" menu in dopesheet while drawing masks #99044

New Issue

Steffen Dünner · 2022-06-21T11:36:01+02:00

Steffen Dünner commented

2022-06-21 11:36:01 +02:00

System Information
Operating system: Linux-5.15.0-33-generic-x86_64-with-glibc2.31 64 Bits
Graphics card: NVIDIA GeForce RTX 2070 Super/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 515.48.07

Blender Version
Broken: version: 3.3.0 Alpha, branch: master, commit date: 2022-06-21 08:10, hash: ee78c860b8
Worked: 2.93.8
3.2.0 Final is also crashing

Short description of error
I noticed that while drawing masks in the VFX > Masking layout I could easily crash Blender by simply trying to open the "Key" menu in the Dopesheet in Mask mode.

Exact steps for others to reproduce the error

Open Blender and open a VFX > Masking layout
Open any movie clip, even a single image will do
Add a new mask
Try clicking on the "Key" menu in the Dopesheet on the upper left. Everything works, no crash.
Add a new mask layer. A simple rectangle or circle will do
Try clicking the "Key" menu again -> crash

2022-06-21 11-34-14.mp4

**System Information** Operating system: Linux-5.15.0-33-generic-x86_64-with-glibc2.31 64 Bits Graphics card: NVIDIA GeForce RTX 2070 Super/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 515.48.07 **Blender Version** Broken: version: 3.3.0 Alpha, branch: master, commit date: 2022-06-21 08:10, hash: `ee78c860b8` Worked: 2.93.8 3.2.0 Final is also crashing **Short description of error** I noticed that while drawing masks in the VFX > Masking layout I could easily crash Blender by simply trying to open the "Key" menu in the Dopesheet in Mask mode. **Exact steps for others to reproduce the error** - Open Blender and open a VFX > Masking layout - Open any movie clip, even a single image will do - Add a new mask - Try clicking on the "Key" menu in the Dopesheet on the upper left. Everything works, no crash. - Add a new mask layer. A simple rectangle or circle will do - Try clicking the "Key" menu again -> crash [2022-06-21 11-34-14.mp4](https://archive.blender.org/developer/F13211688/2022-06-21_11-34-14.mp4)

Steffen Dünner commented

2022-06-21 11:36:01 +02:00

Added subscriber: @SteffenD

Robert Guetzkow commented

2022-06-21 12:21:12 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Robert Guetzkow commented

2022-06-21 12:22:37 +02:00

Added subscriber: @rjg

Robert Guetzkow commented

2022-06-21 12:22:37 +02:00

BKE_fcurve_is_protected(FCurve * fcu) Line 964	C
BKE_fcurve_is_keyframable(FCurve * fcu) Line 975	C
graphop_editable_keyframes_poll(bContext * C) Line 206	C
WM_operator_poll(bContext * C, wmOperatorType * ot) Line 888	C++
wm_operator_invoke(bContext * C, wmOperatorType * ot, const wmEvent * event, PointerRNA * properties, ReportList * reports, const bool poll_only, bool use_last_properties) Line 1351	C++
wm_operator_call_internal(bContext * C, wmOperatorType * ot, PointerRNA * properties, ReportList * reports, const wmOperatorCallContext context, const bool poll_only, const wmEvent * event) Line 1596	C++
WM_operator_poll_context(bContext * C, wmOperatorType * ot, short context) Line 897	C++
ui_but_context_poll_operator_ex(bContext * C, const uiBut * but, const wmOperatorCallParams * optype_params) Line 1896	C++
ui_but_context_poll_operator(bContext * C, wmOperatorType * ot, const uiBut * but) Line 1920	C++
UI_block_end_ex(const bContext * C, uiBlock * block, const int * xy, int * r_xy) Line 1947	C++
ui_popup_block_refresh(bContext * C, uiPopupBlockHandle * handle, ARegion * butregion, uiBut * but) Line 607	C++
ui_popup_block_create(bContext * C, ARegion * butregion, uiBut * but, uiBlock *(*)(bContext *, ARegion *, void *) create_func, uiBlock *(*)(bContext *, uiPopupBlockHandle *, void *) handle_create_func, void * arg, void(*)(void *) arg_free) Line 801	C++
ui_popup_menu_create(bContext * C, ARegion * butregion, uiBut * but, void(*)(bContext *, uiLayout *, void *) menu_func, void * arg) Line 360	C++
ui_block_open_begin(bContext * C, uiBut * but, uiHandleButtonData * data) Line 4267	C
button_activate_state(bContext * C, uiBut * but, uiHandleButtonState state) Line 8422	C
ui_do_but_BLOCK(bContext * C, uiBut * but, uiHandleButtonData * data, const wmEvent * event) Line 6063	C
ui_do_button(bContext * C, uiBlock * block, uiBut * but, const wmEvent * event) Line 8111	C
ui_handle_button_event(bContext * C, const wmEvent * event, uiBut * but) Line 9273	C
ui_region_handler(bContext * C, const wmEvent * event, void * UNUSED_userdata) Line 11360	C
wm_handler_ui_call(bContext * C, wmEventHandler_UI * handler, const wmEvent * event, int always_pass) Line 732	C++
wm_handlers_do_intern(bContext * C, wmWindow * win, wmEvent * event, ListBase * handlers) Line 3166	C++
wm_handlers_do(bContext * C, wmEvent * event, ListBase * handlers) Line 3285	C++
wm_event_do_region_handlers(bContext * C, wmEvent * event, ARegion * region) Line 3706	C++
wm_event_do_handlers_area_regions(bContext * C, wmEvent * event, ScrArea * area) Line 3736	C++
wm_event_do_handlers(bContext * C) Line 3932	C++
WM_main(bContext * C) Line 626	C
main(int argc, const unsigned char * * UNUSED_argv_c) Line 551	C

```lines=10 BKE_fcurve_is_protected(FCurve * fcu) Line 964 C BKE_fcurve_is_keyframable(FCurve * fcu) Line 975 C graphop_editable_keyframes_poll(bContext * C) Line 206 C WM_operator_poll(bContext * C, wmOperatorType * ot) Line 888 C++ wm_operator_invoke(bContext * C, wmOperatorType * ot, const wmEvent * event, PointerRNA * properties, ReportList * reports, const bool poll_only, bool use_last_properties) Line 1351 C++ wm_operator_call_internal(bContext * C, wmOperatorType * ot, PointerRNA * properties, ReportList * reports, const wmOperatorCallContext context, const bool poll_only, const wmEvent * event) Line 1596 C++ WM_operator_poll_context(bContext * C, wmOperatorType * ot, short context) Line 897 C++ ui_but_context_poll_operator_ex(bContext * C, const uiBut * but, const wmOperatorCallParams * optype_params) Line 1896 C++ ui_but_context_poll_operator(bContext * C, wmOperatorType * ot, const uiBut * but) Line 1920 C++ UI_block_end_ex(const bContext * C, uiBlock * block, const int * xy, int * r_xy) Line 1947 C++ ui_popup_block_refresh(bContext * C, uiPopupBlockHandle * handle, ARegion * butregion, uiBut * but) Line 607 C++ ui_popup_block_create(bContext * C, ARegion * butregion, uiBut * but, uiBlock *(*)(bContext *, ARegion *, void *) create_func, uiBlock *(*)(bContext *, uiPopupBlockHandle *, void *) handle_create_func, void * arg, void(*)(void *) arg_free) Line 801 C++ ui_popup_menu_create(bContext * C, ARegion * butregion, uiBut * but, void(*)(bContext *, uiLayout *, void *) menu_func, void * arg) Line 360 C++ ui_block_open_begin(bContext * C, uiBut * but, uiHandleButtonData * data) Line 4267 C button_activate_state(bContext * C, uiBut * but, uiHandleButtonState state) Line 8422 C ui_do_but_BLOCK(bContext * C, uiBut * but, uiHandleButtonData * data, const wmEvent * event) Line 6063 C ui_do_button(bContext * C, uiBlock * block, uiBut * but, const wmEvent * event) Line 8111 C ui_handle_button_event(bContext * C, const wmEvent * event, uiBut * but) Line 9273 C ui_region_handler(bContext * C, const wmEvent * event, void * UNUSED_userdata) Line 11360 C wm_handler_ui_call(bContext * C, wmEventHandler_UI * handler, const wmEvent * event, int always_pass) Line 732 C++ wm_handlers_do_intern(bContext * C, wmWindow * win, wmEvent * event, ListBase * handlers) Line 3166 C++ wm_handlers_do(bContext * C, wmEvent * event, ListBase * handlers) Line 3285 C++ wm_event_do_region_handlers(bContext * C, wmEvent * event, ARegion * region) Line 3706 C++ wm_event_do_handlers_area_regions(bContext * C, wmEvent * event, ScrArea * area) Line 3736 C++ wm_event_do_handlers(bContext * C) Line 3932 C++ WM_main(bContext * C) Line 626 C main(int argc, const unsigned char * * UNUSED_argv_c) Line 551 C ```

Robert Guetzkow commented

2022-06-21 12:27:05 +02:00

The affected code may fall into the responsibility of the Animation & Rigging module, hence I've tagged both.

Robert Guetzkow commented

2022-06-21 22:05:19 +02:00

The issue is that graphop_editable_keyframes_poll (graph_utils.c ) filters for animation data, iterates over the entries, treating all of them as FCurves. However, there can be entries that are no FCurves. Thus, the cast and subsequent operations result in the crash. In this particular case the creation of a mask results in an entry with ale->type set to 38 which is a ANIMTYPE_MASKLAYER. Skipping all entries in the loop that do not have an ale->type of ANIMTYPE_FCURVE seems to fix the issue.

I'm not sure if this covers all relevant cases though, it could be that NLA curves would also needed to be handled or that additional checks for the masks are required.

diff --git a/source/blender/editors/space_graph/graph_utils.c b/source/blender/editors/space_graph/graph_utils.c
index d8baa4c643d..ee03e12fffe 100644
--- a/source/blender/editors/space_graph/graph_utils.c
+++ b/source/blender/editors/space_graph/graph_utils.c
@@ -191,6 +191,10 @@ bool graphop_editable_keyframes_poll(bContext *C)
   }
 
   for (ale = anim_data.first; ale; ale = ale->next) {
+    if (ale->type != ANIMTYPE_FCURVE) {
+      continue;
+    }
+
     FCurve *fcu = (FCurve *)ale->data;
 
     /* editable curves must fulfill the following criteria:

The issue is that `graphop_editable_keyframes_poll` ([graph_utils.c ](https://developer.blender.org/diffusion/B/browse/master/source/blender/editors/space_graph/graph_utils.c)) filters for animation data, iterates over the entries, treating all of them as `FCurve`s. However, there can be entries that are no `FCurve`s. Thus, the cast and subsequent operations result in the crash. In this particular case the creation of a mask results in an entry with `ale->type` set to `38` which is a `ANIMTYPE_MASKLAYER`. Skipping all entries in the loop that do not have an `ale->type` of `ANIMTYPE_FCURVE` seems to fix the issue. I'm not sure if this covers all relevant cases though, it could be that NLA curves would also needed to be handled or that additional checks for the masks are required. ``` diff --git a/source/blender/editors/space_graph/graph_utils.c b/source/blender/editors/space_graph/graph_utils.c index d8baa4c643d..ee03e12fffe 100644 --- a/source/blender/editors/space_graph/graph_utils.c +++ b/source/blender/editors/space_graph/graph_utils.c @@ -191,6 +191,10 @@ bool graphop_editable_keyframes_poll(bContext *C) } for (ale = anim_data.first; ale; ale = ale->next) { + if (ale->type != ANIMTYPE_FCURVE) { + continue; + } + FCurve *fcu = (FCurve *)ale->data; /* editable curves must fulfill the following criteria: ```

Sergey Sharybin commented

2022-11-14 11:47:33 +01:00

Added subscriber: @Sergey

Sergey Sharybin commented

2022-11-14 11:47:33 +01:00

@rjg, Thanks for the investigation. To me it seems that the issue is somewhere else: the graphop_editable_keyframes_poll explicitly uses ANIMFILTER_FCURVESONLY filter, and this is why the loop code does not perform extra checks.

I guess in a sense the animdata_filter_mask_data would need to become something closer to the implementation of animdata_filter_gpencil_data.

@rjg, Thanks for the investigation. To me it seems that the issue is somewhere else: the `graphop_editable_keyframes_poll` explicitly uses `ANIMFILTER_FCURVESONLY` filter, and this is why the loop code does not perform extra checks. I guess in a sense the `animdata_filter_mask_data` would need to become something closer to the implementation of `animdata_filter_gpencil_data`.

Sergey Sharybin self-assigned this 2022-11-14 16:08:46 +01:00

blender-admin commented

2022-11-14 16:19:11 +01:00

This issue was referenced by 44ec911633

This issue was referenced by 44ec91163374472dc63e17eb1966d659eb9a61f2

Sergey Sharybin commented

2022-11-16 14:56:25 +01:00

Changed status from 'Confirmed' to: 'Resolved'

Sergey Sharybin closed this issue

2022-11-16 14:56:25 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Blender instantly closes when clicking on the "Key" menu in dopesheet while drawing masks #99044