Blender crashes trying to load character file #41703

New Issue

bassam kurdali · 2014-09-03T23:46:56+02:00

bassam kurdali commented

2014-09-03 23:46:56 +02:00

System Information
Fedora 20 GNU/Linux 64 bit on Intel CPU / Nvidia GPU

Blender Version
Broken: git master hash f7062ff
Worked: 2.71 release from b.o.

Short description of error
Open a specific file (gilgamesh.blend) crashes on file load (almost all the time) with the following in terminal:

connect failed: No such file or directory
Read new prefs: /home/bassam/.config/blender/2.71/config/userpref.blend
found bundled python: /home/bassam/src/blender/build/bin/2.71/python
read blend: /home/bassam/Documents/gilgameshpacked.blend
Writing: /tmp/gilgameshpacked.crash.txt
***Error in `blender_trunk': double free or corruption (fasttop): 0x00007f081c004f80***
======= Backtrace: =========
/lib64/libc.so.6(+0x75cff)[0x7f0886ce6cff]
/lib64/libc.so.6(+0x7cff8)[0x7f0886cedff8]
Segmentation fault (core dumped)

the crash.txt is here:gilgameshpacked.crash.txt

Exact steps for others to reproduce the error

Download the file here
Open the file in git master

It might crash if your setup reproduces mine....

**System Information** Fedora 20 GNU/Linux 64 bit on Intel CPU / Nvidia GPU **Blender Version** Broken: git master hash f7062ff Worked: 2.71 release from b.o. **Short description of error** Open a specific file (gilgamesh.blend) crashes on file load (almost all the time) with the following in terminal: ``` connect failed: No such file or directory Read new prefs: /home/bassam/.config/blender/2.71/config/userpref.blend found bundled python: /home/bassam/src/blender/build/bin/2.71/python read blend: /home/bassam/Documents/gilgameshpacked.blend Writing: /tmp/gilgameshpacked.crash.txt ***Error in `blender_trunk': double free or corruption (fasttop): 0x00007f081c004f80*** ======= Backtrace: ========= /lib64/libc.so.6(+0x75cff)[0x7f0886ce6cff] /lib64/libc.so.6(+0x7cff8)[0x7f0886cedff8] Segmentation fault (core dumped) ``` the crash.txt is here:[gilgameshpacked.crash.txt](https://archive.blender.org/developer/F108545/gilgameshpacked.crash.txt) **Exact steps for others to reproduce the error** - Download [the file here ](http://urchn.org/misc/gilgameshpacked.blend) - Open the file in git master # It might crash if your setup reproduces mine....

bassam kurdali commented

2014-09-03 23:46:56 +02:00

Changed status to: 'Open'

bassam kurdali commented

2014-09-03 23:46:56 +02:00

Added subscriber: @BassamKurdali

Bastien Montagne commented

2014-09-04 00:41:31 +02:00

Added subscribers: @Sergey, @LukasTonne, @mont29

Bastien Montagne commented

2014-09-04 00:42:38 +02:00

Confirmed, looks like a threading issue in particle code, from quick look to asan backtrace:

P133: (An Untitled Masterwork)

=================================================================
==19652==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040002fa8a0 at pc 0x436ba28 bp 0x7fc324322c80 sp 0x7fc324322c78
READ of size 8 at 0x6040002fa8a0 thread #19
==19652==AddressSanitizer: while reporting a bug found another one.Ignoring.
    #0 0x436ba27 in BLI_addtail /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/listbase.c:94
    #1 0x38cf123 in curve_to_displist /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:347
    #2 0x38d9c5b in do_makeDispListCurveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1545
    #3 0x38dbd5e in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1761
    #4 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277
    #5 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310
    #6 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244
    #7 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293
    #8 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148
    #9 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056
    #10 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193
    #11 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774
    #12 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570
    #13 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277
    #14 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350
    #15 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001
    #16 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365
    #17 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137
    #18 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)
    #19 0x7fc35921cfbc in clone (/lib/x86_64-linux-gnu/libc.so.6+0xe5fbc)

0x6040002fa8a0 is located 16 bytes inside of 48-byte region [0x6040002fa890,0x6040002fa8c0)
freed by thread #16 here:
    #0 0x7fc35f11a887 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54887)
    #1 0x47f6855 in MEM_lockfree_freeN /home/i74700deb64/blender/__work__/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:144
    #2 0x3aec771 in BKE_object_free_derived_caches /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:333
    #3 0x38dbc4e in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1753
    #4 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277
    #5 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310
    #6 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244
    #7 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293
    #8 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148
    #9 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056
    #10 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193
    #11 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774
    #12 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570
    #13 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277
    #14 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350
    #15 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001
    #16 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365
    #17 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137
    #18 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)

previously allocated by thread #19 here:
    #0 0x7fc35f11abe5 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54be5)
    #1 0x47f7300 in MEM_lockfree_callocN /home/i74700deb64/blender/__work__/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:261
    #2 0x38dbcc1 in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1756
    #3 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277
    #4 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310
    #5 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244
    #6 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293
    #7 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148
    #8 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056
    #9 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193
    #10 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774
    #11 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570
    #12 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277
    #13 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350
    #14 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001
    #15 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365
    #16 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137
    #17 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)

Thread #19 created by T0 here:
    #0 0x7fc35f0e9b0a in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23b0a)
    #1 0x441ba38 in BLI_task_scheduler_create /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:184
    #2 0x441cc33 in BLI_task_scheduler_get /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:173
    #3 0x3bf3ff8 in scene_update_objects /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1477
    #4 0x3bf43ae in scene_update_tagged_recursive /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1552
    #5 0x3bf4995 in BKE_scene_update_tagged /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1639
    #6 0x1e528e3 in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:378
    #7 0x1e425ca in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:495
    #8 0x1e4057f in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1761
    #9 0x7fc359158b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)

Thread #16 created by T0 here:
    #0 0x7fc35f0e9b0a in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23b0a)
    #1 0x441ba38 in BLI_task_scheduler_create /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:184
    #2 0x441cc33 in BLI_task_scheduler_get /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:173
    #3 0x3bf3ff8 in scene_update_objects /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1477
    #4 0x3bf43ae in scene_update_tagged_recursive /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1552
    #5 0x3bf4995 in BKE_scene_update_tagged /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1639
    #6 0x1e528e3 in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:378
    #7 0x1e425ca in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:495
    #8 0x1e4057f in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1761
    #9 0x7fc359158b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)

SUMMARY: AddressSanitizer: heap-use-after-free /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/listbase.c:94 BLI_addtail
Shadow bytes around the buggy address:
  0x0c08800574c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c08800574d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c08800574e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c08800574f0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa
  0x0c0880057500: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00
=>0x0c0880057510: fa fa fd fd[fd]fd fd fd fa fa fa fa fa fa fa fa
  0x0c0880057520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0880057530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0880057540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0880057550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0880057560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==19652==ABORTING

Confirmed, looks like a threading issue in particle code, from quick look to asan backtrace: [P133: (An Untitled Masterwork)](https://archive.blender.org/developer/P133.txt) ``` ================================================================= ==19652==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040002fa8a0 at pc 0x436ba28 bp 0x7fc324322c80 sp 0x7fc324322c78 READ of size 8 at 0x6040002fa8a0 thread #19 ==19652==AddressSanitizer: while reporting a bug found another one.Ignoring. #0 0x436ba27 in BLI_addtail /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/listbase.c:94 #1 0x38cf123 in curve_to_displist /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:347 #2 0x38d9c5b in do_makeDispListCurveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1545 #3 0x38dbd5e in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1761 #4 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277 #5 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310 #6 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244 #7 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293 #8 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148 #9 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056 #10 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193 #11 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774 #12 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570 #13 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277 #14 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350 #15 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001 #16 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365 #17 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137 #18 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3) #19 0x7fc35921cfbc in clone (/lib/x86_64-linux-gnu/libc.so.6+0xe5fbc) 0x6040002fa8a0 is located 16 bytes inside of 48-byte region [0x6040002fa890,0x6040002fa8c0) freed by thread #16 here: #0 0x7fc35f11a887 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54887) #1 0x47f6855 in MEM_lockfree_freeN /home/i74700deb64/blender/__work__/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:144 #2 0x3aec771 in BKE_object_free_derived_caches /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:333 #3 0x38dbc4e in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1753 #4 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277 #5 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310 #6 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244 #7 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293 #8 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148 #9 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056 #10 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193 #11 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774 #12 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570 #13 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277 #14 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350 #15 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001 #16 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365 #17 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137 #18 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3) previously allocated by thread #19 here: #0 0x7fc35f11abe5 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54be5) #1 0x47f7300 in MEM_lockfree_callocN /home/i74700deb64/blender/__work__/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:261 #2 0x38dbcc1 in BKE_displist_make_curveTypes /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/displist.c:1756 #3 0x39641e6 in precalculate_effector /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:277 #4 0x396491c in pdPrecalculateEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:310 #5 0x39639ca in pdInitEffectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/effect.c:244 #6 0x3b6c52b in psys_update_effectors /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:2293 #7 0x3b7ea41 in hair_step /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:4148 #8 0x3b87c7e in particle_system_update /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/particle_system.c:5056 #9 0x320ccee in deformVerts /home/i74700deb64/blender/__work__/src/source/blender/modifiers/intern/MOD_particlesystem.c:193 #10 0x3a988fb in modwrap_deformVerts /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/modifier.c:774 #11 0x378738c in mesh_calc_modifiers /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:1570 #12 0x378c424 in mesh_build_data /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2277 #13 0x378cc63 in makeDerivedMesh /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/DerivedMesh.c:2350 #14 0x3b01a3c in BKE_object_handle_update_ex /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/object.c:3001 #15 0x3bf39ec in scene_update_object_func /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1365 #16 0x441b56c in task_scheduler_thread_run /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:137 #17 0x7fc35d15f0a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3) Thread #19 created by T0 here: #0 0x7fc35f0e9b0a in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23b0a) #1 0x441ba38 in BLI_task_scheduler_create /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:184 #2 0x441cc33 in BLI_task_scheduler_get /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:173 #3 0x3bf3ff8 in scene_update_objects /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1477 #4 0x3bf43ae in scene_update_tagged_recursive /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1552 #5 0x3bf4995 in BKE_scene_update_tagged /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1639 #6 0x1e528e3 in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:378 #7 0x1e425ca in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:495 #8 0x1e4057f in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1761 #9 0x7fc359158b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) Thread #16 created by T0 here: #0 0x7fc35f0e9b0a in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23b0a) #1 0x441ba38 in BLI_task_scheduler_create /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/task.c:184 #2 0x441cc33 in BLI_task_scheduler_get /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:173 #3 0x3bf3ff8 in scene_update_objects /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1477 #4 0x3bf43ae in scene_update_tagged_recursive /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1552 #5 0x3bf4995 in BKE_scene_update_tagged /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/scene.c:1639 #6 0x1e528e3 in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:378 #7 0x1e425ca in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:495 #8 0x1e4057f in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1761 #9 0x7fc359158b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) SUMMARY: AddressSanitizer: heap-use-after-free /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/listbase.c:94 BLI_addtail Shadow bytes around the buggy address: 0x0c08800574c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c08800574d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c08800574e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c08800574f0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 fa 0x0c0880057500: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 =>0x0c0880057510: fa fa fd fd[fd]fd fd fd fa fa fa fa fa fa fa fa 0x0c0880057520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0880057530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0880057540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0880057550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0880057560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==19652==ABORTING ```

bassam kurdali commented

2014-09-04 01:12:32 +02:00

Thanks Bastien!

Bastien Montagne commented

2014-09-04 15:50:42 +02:00

@BassamKurdali: temp workaround: launch Blender with -t 1 option (no multi-threading, things will be a bit slower, but at least it loads!).

@BassamKurdali: temp workaround: launch Blender with `-t 1` option (no multi-threading, things will be a bit slower, but at least it loads!).

bassam kurdali commented

2014-09-04 19:34:24 +02:00

cool, thanks! will do for now.

Bastien Montagne commented

2014-09-04 19:58:09 +02:00

Ok, tech dev notes.

Here is exactly what happens: a same curve, used as CurveForceField, is evaluated by several hair systems at the same time (threaded depsgraph), without any protection.

More precisely, in effect.c, precalculate_effector() ends being called with effectors using the same curve object in parallel, which crashes when calling BKE_displist_make_curveTypes(), as one can expects!

This very simple patch fixes it, not quite sure it would be considered as correct though… :P

P136: #41703

diff --git a/source/blender/blenkernel/intern/effect.c b/source/blender/blenkernel/intern/effect.c
index 4859aa8..92b8349 100644
--- a/source/blender/blenkernel/intern/effect.c
+++ b/source/blender/blenkernel/intern/effect.c
@@ -262,6 +262,7 @@ void pdEndEffectors(ListBase **effectors)
 	}
 }
 
+#include "BLI_threads.h"
 static void precalculate_effector(EffectorCache *eff)
 {
 	unsigned int cfra = (unsigned int)(eff->scene->r.cfra >= 0 ? eff->scene->r.cfra : -eff->scene->r.cfra);
@@ -273,8 +274,10 @@ static void precalculate_effector(EffectorCache *eff)
 	if (eff->pd->forcefield == PFIELD_GUIDE && eff->ob->type==OB_CURVE) {
 		Curve *cu= eff->ob->data;
 		if (cu->flag & CU_PATH) {
+			BLI_lock_thread(LOCK_CUSTOM1);
 			if (eff->ob->curve_cache == NULL || eff->ob->curve_cache->path==NULL || eff->ob->curve_cache->path->data==NULL)
 				BKE_displist_make_curveTypes(eff->scene, eff->ob, 0);
+			BLI_unlock_thread(LOCK_CUSTOM1);
 
 			if (eff->ob->curve_cache->path && eff->ob->curve_cache->path->data) {
 				where_on_path(eff->ob, 0.0, eff->guide_loc, eff->guide_dir, NULL, &eff->guide_radius, NULL);

Ok, tech dev notes. Here is exactly what happens: a same curve, used as CurveForceField, is evaluated by several hair systems at the same time (threaded depsgraph), without any protection. More precisely, in effect.c, `precalculate_effector()` ends being called with effectors using the same curve object in parallel, which crashes when calling `BKE_displist_make_curveTypes()`, as one can expects! This very simple patch fixes it, not quite sure it would be considered as correct though… :P [P136: #41703](https://archive.blender.org/developer/P136.txt) ``` diff --git a/source/blender/blenkernel/intern/effect.c b/source/blender/blenkernel/intern/effect.c index 4859aa8..92b8349 100644 --- a/source/blender/blenkernel/intern/effect.c +++ b/source/blender/blenkernel/intern/effect.c @@ -262,6 +262,7 @@ void pdEndEffectors(ListBase **effectors) } } +#include "BLI_threads.h" static void precalculate_effector(EffectorCache *eff) { unsigned int cfra = (unsigned int)(eff->scene->r.cfra >= 0 ? eff->scene->r.cfra : -eff->scene->r.cfra); @@ -273,8 +274,10 @@ static void precalculate_effector(EffectorCache *eff) if (eff->pd->forcefield == PFIELD_GUIDE && eff->ob->type==OB_CURVE) { Curve *cu= eff->ob->data; if (cu->flag & CU_PATH) { + BLI_lock_thread(LOCK_CUSTOM1); if (eff->ob->curve_cache == NULL || eff->ob->curve_cache->path==NULL || eff->ob->curve_cache->path->data==NULL) BKE_displist_make_curveTypes(eff->scene, eff->ob, 0); + BLI_unlock_thread(LOCK_CUSTOM1); if (eff->ob->curve_cache->path && eff->ob->curve_cache->path->data) { where_on_path(eff->ob, 0.0, eff->guide_loc, eff->guide_dir, NULL, &eff->guide_radius, NULL); ```

Bastien Montagne self-assigned this 2014-09-04 20:10:13 +02:00

Sergey Sharybin commented

2014-09-04 21:02:35 +02:00

This is not gonna to work -- it doesn't protect you from cases when effector and object which shares the same curve datablock are handled in separate thread simultaneously. Ideally the cache is to be existing here. Not sure we can add a proper dependency in the graph to make it handled all nicely without hack.

f not, better workaround would be to make sure effectors' dependencies are up to date before doing threading in the scene_update_objects().

This is not gonna to work -- it doesn't protect you from cases when effector and object which shares the same curve datablock are handled in separate thread simultaneously. Ideally the cache is to be existing here. Not sure we can add a proper dependency in the graph to make it handled all nicely without hack. f not, better workaround would be to make sure effectors' dependencies are up to date before doing threading in the `scene_update_objects()`.

Bastien Montagne commented

2014-09-05 09:10:24 +02:00

Ok, so depsgraph does create valid dependencies between particle systems and forcefields.

Issue here is that when curve objects are updated (in BKE_object_handle_update_ex()), OB_RECALC_DATA is not set, so for curves, curve_cache is not handled, even if empty.

In following patch, it's creation is forced in this update func, when empty, so that precalculate_effector() never has to call it later:

P137: #41703

diff --git a/source/blender/blenkernel/intern/object.c b/source/blender/blenkernel/intern/object.c
index b090165..a6e48fe 100644
--- a/source/blender/blenkernel/intern/object.c
+++ b/source/blender/blenkernel/intern/object.c
@@ -3108,6 +3108,14 @@ void BKE_object_handle_update_ex(EvaluationContext *eval_ctx,
 		ob->recalc &= ~OB_RECALC_ALL;
 	}
 
+	/* Force populating of curve cache, if it is empty. */
+	if (ELEM(ob->type, OB_CURVE, OB_SURF, OB_FONT) &&
+	    (ob->curve_cache == NULL || ob->curve_cache->path == NULL || ob->curve_cache->path->data == NULL))
+	{
+		BKE_displist_make_curveTypes(scene, ob, 0);
+	}
+
+
 	/* the case when this is a group proxy, object_update is called in group.c */
 	if (ob->proxy) {
 		/* set pointer in library proxy target, for copying, but restore it */

As usual, not sure we want to do this, or to do this here, etc. ;)

Ok, so depsgraph does create valid dependencies between particle systems and forcefields. Issue here is that when curve objects are updated (in `BKE_object_handle_update_ex()`), OB_RECALC_DATA is not set, so for curves, curve_cache is not handled, even if empty. In following patch, it's creation is forced in this update func, when empty, so that `precalculate_effector()` never has to call it later: [P137: #41703](https://archive.blender.org/developer/P137.txt) ``` diff --git a/source/blender/blenkernel/intern/object.c b/source/blender/blenkernel/intern/object.c index b090165..a6e48fe 100644 --- a/source/blender/blenkernel/intern/object.c +++ b/source/blender/blenkernel/intern/object.c @@ -3108,6 +3108,14 @@ void BKE_object_handle_update_ex(EvaluationContext *eval_ctx, ob->recalc &= ~OB_RECALC_ALL; } + /* Force populating of curve cache, if it is empty. */ + if (ELEM(ob->type, OB_CURVE, OB_SURF, OB_FONT) && + (ob->curve_cache == NULL || ob->curve_cache->path == NULL || ob->curve_cache->path->data == NULL)) + { + BKE_displist_make_curveTypes(scene, ob, 0); + } + + /* the case when this is a group proxy, object_update is called in group.c */ if (ob->proxy) { /* set pointer in library proxy target, for copying, but restore it */ ``` As usual, not sure we want to do this, or to do this here, etc. ;)

Sergey Sharybin commented

2014-09-05 09:32:11 +02:00

That's suffers exactly the same issue as the previous fix -- in certain circumstances it's still possible to have threading conflict.

Plus it should not be applied for curve objects in general (the patch simply makes it so any tag for curve update will imply data re-evaluation here, which is screwing up the system even more.

If the dependency between an effector and curve exists, check whether effector depends on both object and object data.

That's suffers exactly the same issue as the previous fix -- in certain circumstances it's still possible to have threading conflict. Plus it should not be applied for curve objects in general (the patch simply makes it so any tag for curve update will imply data re-evaluation here, which is screwing up the system even more. If the dependency between an effector and curve exists, check whether effector depends on both object and object data.

Bastien Montagne commented

2014-09-05 17:43:58 +02:00

Ok, digging more and more, and understanding less and less… :(

Think core of the issue is that, during first evaluation of brand new DAG (just after file loading), all curve guides objects are tagged as not needing any recalc. I tried to reproduce a somewhat simpler similar situation, with only a few hairs & curve_guides (see file attached below), but with this one curve guides are always tagged to recalc after loading…

depsgraph_curve_field.blend

Note I tried to force curveguides to recalc in several places (including while building DAG, which is not nice I guess), but curveguides always remain with a 0 recalc when DAG is evaluated, which means I think their recalc flags are reset somewhere after DAG construction, but before its evaluation… Tbh, I’m lost at this point…

Ok, digging more and more, and understanding less and less… :( Think core of the issue is that, during first evaluation of brand new DAG (just after file loading), all curve guides objects are tagged as not needing any recalc. I tried to reproduce a somewhat simpler similar situation, with only a few hairs & curve_guides (see file attached below), but with this one curve guides are always tagged to recalc after loading… [depsgraph_curve_field.blend](https://archive.blender.org/developer/F109044/depsgraph_curve_field.blend) Note I tried to force curveguides to recalc in several places (including while building DAG, which is not nice I guess), but curveguides always remain with a 0 recalc when DAG is evaluated, which means I think their recalc flags are reset somewhere **after** DAG construction, but **before** its evaluation… Tbh, I’m lost at this point…

Bastien Montagne commented

2014-09-05 18:55:50 +02:00

Found more: what happens is, flush_update_node() untag our curve guids as needing recalc, since they are on hidden layers.

Do not understand why it still evaluates hair emitters, though, since they are also on hidden layer!

Found more: what happens is, `flush_update_node()` untag our curve guids as needing recalc, since they are on hidden layers. Do not understand why it still evaluates hair emitters, though, since they are also on hidden layer!

Bastien Montagne commented

2014-09-05 22:22:45 +02:00

Long story short: flush_pointcache_reset() set 'pointcache' objects (like those having a psys etc.) recalc flag to OB_RECALC_DATA regardless of whether they are on invisible layer or not, which breaks work done previously by flush_update_node() on this aspect.

That small patch (yeah, one more) does fix crash, but as usual I’m not quite sure it is valid - maybe a better solution would be to add a temp 'OB_RECALC_HIDDEN' flag, set by flush_update_node() and which would prevent any later code to re-enable those objects' recalc? Very hard to take everything into account here, I feel a bit like fighting in a giant plate of spaghetti!

P138: #41703

diff --git a/source/blender/blenkernel/intern/depsgraph.c b/source/blender/blenkernel/intern/depsgraph.c
index eeda9b0..82f1dfb 100644
--- a/source/blender/blenkernel/intern/depsgraph.c
+++ b/source/blender/blenkernel/intern/depsgraph.c
@@ -1787,7 +1787,7 @@ static void flush_pointcache_reset(Main *bmain, Scene *scene, DagNode *node, int
 				ob = (Object *)(itA->node->ob);
 
 				if (reset || (ob->recalc & OB_RECALC_ALL)) {
-					if (BKE_ptcache_object_reset(scene, ob, PTCACHE_RESET_DEPSGRAPH)) {
+					if (BKE_ptcache_object_reset(scene, ob, PTCACHE_RESET_DEPSGRAPH) && (ob->recalc & OB_RECALC_ALL)) {
 						ob->recalc |= OB_RECALC_DATA;
 						lib_id_recalc_data_tag(bmain, &ob->id);
 					}

Long story short: `flush_pointcache_reset()` set 'pointcache' objects (like those having a psys etc.) recalc flag to `OB_RECALC_DATA` regardless of whether they are on invisible layer or not, which breaks work done previously by `flush_update_node()` on this aspect. That small patch (yeah, one more) does fix crash, but as usual I’m not quite sure it is valid - maybe a better solution would be to add a temp 'OB_RECALC_HIDDEN' flag, set by `flush_update_node()` and which would prevent any later code to re-enable those objects' recalc? Very hard to take everything into account here, I feel a bit like fighting in a giant plate of spaghetti! [P138: #41703](https://archive.blender.org/developer/P138.txt) ``` diff --git a/source/blender/blenkernel/intern/depsgraph.c b/source/blender/blenkernel/intern/depsgraph.c index eeda9b0..82f1dfb 100644 --- a/source/blender/blenkernel/intern/depsgraph.c +++ b/source/blender/blenkernel/intern/depsgraph.c @@ -1787,7 +1787,7 @@ static void flush_pointcache_reset(Main *bmain, Scene *scene, DagNode *node, int ob = (Object *)(itA->node->ob); if (reset || (ob->recalc & OB_RECALC_ALL)) { - if (BKE_ptcache_object_reset(scene, ob, PTCACHE_RESET_DEPSGRAPH)) { + if (BKE_ptcache_object_reset(scene, ob, PTCACHE_RESET_DEPSGRAPH) && (ob->recalc & OB_RECALC_ALL)) { ob->recalc |= OB_RECALC_DATA; lib_id_recalc_data_tag(bmain, &ob->id); } ```

blender-admin commented

2014-09-08 11:49:55 +02:00

This issue was referenced by 9c19ad1f79

This issue was referenced by 9c19ad1f79d0702ef128509232f9e8613076ffea

Bastien Montagne commented

2014-09-08 11:53:47 +02:00

Changed status from 'Open' to: 'Resolved'

Bastien Montagne closed this issue

2014-09-08 11:53:47 +02:00

Bastien Montagne commented

2014-09-08 11:53:47 +02:00

Closed by commit 9c19ad1f79.