Crash Upon Opening File #43283

New Issue

Zauber Paracelsus · 2015-01-16T19:41:14+01:00

Zauber Paracelsus commented

2015-01-16 19:41:14 +01:00

System Information
64bit Manjaro Linux, kernel 3.14.27
GeForce GTX 650 Ti, driver version 343.36

Blender Version
Broken: (example: 2.73 c24b694, see splash screen)

Short description of error
I lost about a day's worth of work after inadvertently introducing an object which would, with very specific circumstances, cause blender to crash if you opened the file or used the Undo function. After narrowing down the issue, it appears to occur with a specific object that uses the Mirror, Armature, Solidify, and Subdivision modifiers (in that order), and the crash condition is created when weights have been transferred to the affected object.

Exact steps for others to reproduce the error
Just open this file: NoseScalesCrash.blend

Note 1: Splicing the problem object off into a separate file was tricky, since blender would sometimes crash when simply pasting a copy of the object!
Note 2: I also tested with the windows version of Blender, by running it under WINE. The crash still occurs there.

**System Information** 64bit Manjaro Linux, kernel 3.14.27 GeForce GTX 650 Ti, driver version 343.36 **Blender Version** Broken: (example: 2.73 c24b694, see splash screen) **Short description of error** I lost about a day's worth of work after inadvertently introducing an object which would, with very specific circumstances, cause blender to crash if you opened the file or used the Undo function. After narrowing down the issue, it appears to occur with a specific object that uses the Mirror, Armature, Solidify, and Subdivision modifiers (in that order), and the crash condition is created when weights have been transferred to the affected object. **Exact steps for others to reproduce the error** Just open this file: [NoseScalesCrash.blend](https://archive.blender.org/developer/F137535/NoseScalesCrash.blend) **Note 1:** Splicing the problem object off into a separate file was tricky, since blender would sometimes crash when simply pasting a copy of the object! **Note 2:** I also tested with the windows version of Blender, by running it under WINE. The crash still occurs there.

Zauber Paracelsus commented

2015-01-16 19:41:14 +01:00

Changed status to: 'Open'

Zauber Paracelsus commented

2015-01-16 19:41:14 +01:00

Added subscriber: @ZauberParacelsus

Bastien Montagne commented

2015-01-17 00:49:25 +01:00

Added subscribers: @Sergey, @ideasman42, @mont29

Bastien Montagne commented

2015-01-17 00:49:25 +01:00

Ouch, looks to me that .blend file is heavily corrupted… At least, that’s what I can guess from that backtrace:

P186: #43283

(gdb) bt
#0  0x00007ffff6f5dd70 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.1
#1  0x00007ffff6f337ad in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1
#2  0x00000000048324d8 in mywrite (wd=0x60700019afc8, 
    adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>, len=1104)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:404
#3  0x00000000048329be in writestruct_at_address (wd=0x60700019afc8, filecode=1096040772, structname=0x87b9e00 "MDeformWeight", nr=138, 
    adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>, 
    data=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:476
#4  0x0000000004832a4d in writestruct (wd=0x60700019afc8, filecode=1096040772, structname=0x87b9e00 "MDeformWeight", nr=138, 
    adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:481
#5  0x000000000483c3bf in write_dverts (wd=0x60700019afc8, count=53, dvlist=0x618000654088) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1823
#6  0x000000000483cbac in write_customdata (wd=0x60700019afc8, id=0x7fffffffc6d0, count=53, data=0x7fffffffc7e8, partial_type=-1, partial_count=0)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1892
#7  0x000000000483d6f0 in write_meshes (wd=0x60700019afc8, idbase=0x61c00009a4f8) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1967
#8  0x00000000048489bb in write_file_handle (mainvar=0x61c00009a088, ww=0x0, compare=0x0, current=0x6190003c6dd8, write_user_block=0, write_flags=33558530, thumb=0x0)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3546
#9  0x00000000048496f9 in BLO_write_file_mem (mainvar=0x61c00009a088, compare=0x0, current=0x6190003c6dd8, write_flags=33558530)
    at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3724
#10 0x0000000003cd2f84 in BKE_write_undo (C=0x60b00000af98, name=0x81881c0 "original") at /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/blender.c:705
#11 0x00000000021570b2 in WM_file_read (C=0x60b00000af98, filepath=0x7fffffffd470 "/home/i74700deb64/Téléchargements/NoseScalesCrash.blend", reports=0x6040002e5f98)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_files.c:510
#12 0x00000000021791a6 in wm_file_read_opwrap (C=0x60b00000af98, filepath=0x7fffffffd470 "/home/i74700deb64/Téléchargements/NoseScalesCrash.blend", reports=0x6040002e5f98, autoexec_init=false)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2328
#13 0x0000000002179734 in wm_open_mainfile_exec (C=0x60b00000af98, op=0x60f00014f598) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2387
#14 0x0000000002147837 in wm_operator_invoke (C=0x60b00000af98, ot=0x61000008f448, event=0x0, properties=0x7fffffffdb10, reports=0x0, poll_only=false)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1046
#15 0x0000000002148545 in wm_operator_call_internal (C=0x60b00000af98, ot=0x61000008f448, properties=0x7fffffffdb10, reports=0x0, context=7, poll_only=false)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1225
#16 0x00000000021487a6 in WM_operator_name_call_ptr (C=0x60b00000af98, ot=0x61000008f448, context=7, properties=0x7fffffffdb10)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1273
#17 0x00000000028f8429 in ui_apply_but_funcs_after (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:667
#18 0x000000000293d03e in ui_popup_handler (C=0x60b00000af98, event=0x60c000227808, userdata=0x611000849588) at /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:9257
#19 0x0000000002143571 in wm_handler_ui_call (C=0x60b00000af98, handler=0x60d00024e808, event=0x60c000227808, always_pass=0)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:424
#20 0x000000000214c1dc in wm_handlers_do_intern (C=0x60b00000af98, event=0x60c000227808, handlers=0x61200004bea0)
    at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1925
#21 0x000000000214c7fc in wm_handlers_do (C=0x60b00000af98, event=0x60c000227808, handlers=0x61200004bea0) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2009
#22 0x000000000214e127 in wm_event_do_handlers (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2292
#23 0x0000000002132bbb in WM_main (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:489
#24 0x0000000002130acb in main (argc=1, argv=0x7fffffffe268) at /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1740
(gdb) continue
Continuing.
=================================================================
==22007==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000008fe3c9e at pc 0x7ffff6f33792 bp 0x7fffffffc2d0 sp 0x7fffffffba90
READ of size 1104 at 0x000008fe3c9e thread T0
    #0 0x7ffff6f33791 (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2e791)
    #1 0x48324d7 in mywrite /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:404
    #2 0x48329bd in writestruct_at_address /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:476
    #3 0x4832a4c in writestruct /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:481
    #4 0x483c3be in write_dverts /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1823
    #5 0x483cbab in write_customdata /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1892
    #6 0x483d6ef in write_meshes /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1967
    #7 0x48489ba in write_file_handle /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3546
    #8 0x48496f8 in BLO_write_file_mem /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3724
    #9 0x3cd2f83 in BKE_write_undo /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/blender.c:705
    #10 0x21570b1 in WM_file_read /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_files.c:510
    #11 0x21791a5 in wm_file_read_opwrap /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2328
    #12 0x2179733 in wm_open_mainfile_exec /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2387
    #13 0x2147836 in wm_operator_invoke /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1046
    #14 0x2148544 in wm_operator_call_internal /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1225
    #15 0x21487a5 in WM_operator_name_call_ptr /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1273
    #16 0x28f8428 in ui_apply_but_funcs_after /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:667
    #17 0x293d03d in ui_popup_handler /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:9257
    #18 0x2143570 in wm_handler_ui_call /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:424
    #19 0x214c1db in wm_handlers_do_intern /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1925
    #20 0x214c7fb in wm_handlers_do /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2009
    #21 0x214e126 in wm_event_do_handlers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2292
    #22 0x2132bba in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:489
    #23 0x2130aca in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1740
    #24 0x7ffff0ef4b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
    #25 0x212b68e (/home/i74700deb64/blender/__work__/build_cmake_dbg/bin/blender+0x212b68e)

0x000008fe3c9e is located 0 bytes to the right of global variable '__PRETTY_FUNCTION__' from '/home/i74700deb64/blender/__work__/src/extern/libmv/third_party/ceres/internal/ceres/generated/partitioned_matrix_view_2_4_3.cc' (0x8fe3a80) of size 542
  '__PRETTY_FUNCTION__' is ascii string 'Eigen::CoeffBasedProduct<Lhs, Rhs, NestingFlags>::CoeffBasedProduct(const Lhs&, const Rhs&) [with Lhs = Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; Rhs = Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; LhsNested = const Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; RhsNested = const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; int NestingFlags = 6]'
0x000008fe3c9e is located 34 bytes to the left of global variable '__PRETTY_FUNCTION__' from '/home/i74700deb64/blender/__work__/src/extern/libmv/third_party/ceres/internal/ceres/generated/partitioned_matrix_view_2_4_3.cc' (0x8fe3cc0) of size 544
  '__PRETTY_FUNCTION__' is ascii string 'Eigen::CoeffBasedProduct<Lhs, Rhs, NestingFlags>::CoeffBasedProduct(const Lhs&, const Rhs&) [with Lhs = Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; Rhs = Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; LhsNested = const Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; RhsNested = const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; int NestingFlags = 256]'
SUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ??
Shadow bytes around the buggy address:
  0x0000811f4740: 00 00 00 00 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9
  0x0000811f4750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f4760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f4770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f4780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0000811f4790: 00 00 00[06]f9 f9 f9 f9 00 00 00 00 00 00 00 00
  0x0000811f47a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f47b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f47c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000811f47d0: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x0000811f47e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==22007==ABORTING

Looks like some pointer in the file has ugly bad value?

Ouch, looks to me that .blend file is heavily corrupted… At least, that’s what I can guess from that backtrace: [P186: #43283](https://archive.blender.org/developer/P186.txt) ``` (gdb) bt #0 0x00007ffff6f5dd70 in __asan_report_error () from /usr/lib/x86_64-linux-gnu/libasan.so.1 #1 0x00007ffff6f337ad in ?? () from /usr/lib/x86_64-linux-gnu/libasan.so.1 #2 0x00000000048324d8 in mywrite (wd=0x60700019afc8, adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>, len=1104) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:404 #3 0x00000000048329be in writestruct_at_address (wd=0x60700019afc8, filecode=1096040772, structname=0x87b9e00 "MDeformWeight", nr=138, adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>, data=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:476 #4 0x0000000004832a4d in writestruct (wd=0x60700019afc8, filecode=1096040772, structname=0x87b9e00 "MDeformWeight", nr=138, adr=0x8fe3c08 <_ZZN5Eigen17CoeffBasedProductIKNS_9TransposeIKNS_3MapIKNS_6MatrixIdLi2ELi3ELi1ELi2ELi3EEELi0ENS_6StrideILi0ELi0EEEEEEES9_Li6EEC4ISA_S8_EERKT_RKT0_E19__PRETTY_FUNCTION__+392>) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:481 #5 0x000000000483c3bf in write_dverts (wd=0x60700019afc8, count=53, dvlist=0x618000654088) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1823 #6 0x000000000483cbac in write_customdata (wd=0x60700019afc8, id=0x7fffffffc6d0, count=53, data=0x7fffffffc7e8, partial_type=-1, partial_count=0) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1892 #7 0x000000000483d6f0 in write_meshes (wd=0x60700019afc8, idbase=0x61c00009a4f8) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1967 #8 0x00000000048489bb in write_file_handle (mainvar=0x61c00009a088, ww=0x0, compare=0x0, current=0x6190003c6dd8, write_user_block=0, write_flags=33558530, thumb=0x0) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3546 #9 0x00000000048496f9 in BLO_write_file_mem (mainvar=0x61c00009a088, compare=0x0, current=0x6190003c6dd8, write_flags=33558530) at /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3724 #10 0x0000000003cd2f84 in BKE_write_undo (C=0x60b00000af98, name=0x81881c0 "original") at /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/blender.c:705 #11 0x00000000021570b2 in WM_file_read (C=0x60b00000af98, filepath=0x7fffffffd470 "/home/i74700deb64/Téléchargements/NoseScalesCrash.blend", reports=0x6040002e5f98) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_files.c:510 #12 0x00000000021791a6 in wm_file_read_opwrap (C=0x60b00000af98, filepath=0x7fffffffd470 "/home/i74700deb64/Téléchargements/NoseScalesCrash.blend", reports=0x6040002e5f98, autoexec_init=false) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2328 #13 0x0000000002179734 in wm_open_mainfile_exec (C=0x60b00000af98, op=0x60f00014f598) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2387 #14 0x0000000002147837 in wm_operator_invoke (C=0x60b00000af98, ot=0x61000008f448, event=0x0, properties=0x7fffffffdb10, reports=0x0, poll_only=false) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1046 #15 0x0000000002148545 in wm_operator_call_internal (C=0x60b00000af98, ot=0x61000008f448, properties=0x7fffffffdb10, reports=0x0, context=7, poll_only=false) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1225 #16 0x00000000021487a6 in WM_operator_name_call_ptr (C=0x60b00000af98, ot=0x61000008f448, context=7, properties=0x7fffffffdb10) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1273 #17 0x00000000028f8429 in ui_apply_but_funcs_after (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:667 #18 0x000000000293d03e in ui_popup_handler (C=0x60b00000af98, event=0x60c000227808, userdata=0x611000849588) at /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:9257 #19 0x0000000002143571 in wm_handler_ui_call (C=0x60b00000af98, handler=0x60d00024e808, event=0x60c000227808, always_pass=0) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:424 #20 0x000000000214c1dc in wm_handlers_do_intern (C=0x60b00000af98, event=0x60c000227808, handlers=0x61200004bea0) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1925 #21 0x000000000214c7fc in wm_handlers_do (C=0x60b00000af98, event=0x60c000227808, handlers=0x61200004bea0) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2009 #22 0x000000000214e127 in wm_event_do_handlers (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2292 #23 0x0000000002132bbb in WM_main (C=0x60b00000af98) at /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:489 #24 0x0000000002130acb in main (argc=1, argv=0x7fffffffe268) at /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1740 (gdb) continue Continuing. ================================================================= ==22007==ERROR: AddressSanitizer: global-buffer-overflow on address 0x000008fe3c9e at pc 0x7ffff6f33792 bp 0x7fffffffc2d0 sp 0x7fffffffba90 READ of size 1104 at 0x000008fe3c9e thread T0 #0 0x7ffff6f33791 (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x2e791) #1 0x48324d7 in mywrite /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:404 #2 0x48329bd in writestruct_at_address /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:476 #3 0x4832a4c in writestruct /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:481 #4 0x483c3be in write_dverts /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1823 #5 0x483cbab in write_customdata /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1892 #6 0x483d6ef in write_meshes /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:1967 #7 0x48489ba in write_file_handle /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3546 #8 0x48496f8 in BLO_write_file_mem /home/i74700deb64/blender/__work__/src/source/blender/blenloader/intern/writefile.c:3724 #9 0x3cd2f83 in BKE_write_undo /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/blender.c:705 #10 0x21570b1 in WM_file_read /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_files.c:510 #11 0x21791a5 in wm_file_read_opwrap /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2328 #12 0x2179733 in wm_open_mainfile_exec /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_operators.c:2387 #13 0x2147836 in wm_operator_invoke /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1046 #14 0x2148544 in wm_operator_call_internal /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1225 #15 0x21487a5 in WM_operator_name_call_ptr /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1273 #16 0x28f8428 in ui_apply_but_funcs_after /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:667 #17 0x293d03d in ui_popup_handler /home/i74700deb64/blender/__work__/src/source/blender/editors/interface/interface_handlers.c:9257 #18 0x2143570 in wm_handler_ui_call /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:424 #19 0x214c1db in wm_handlers_do_intern /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:1925 #20 0x214c7fb in wm_handlers_do /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2009 #21 0x214e126 in wm_event_do_handlers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:2292 #22 0x2132bba in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:489 #23 0x2130aca in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1740 #24 0x7ffff0ef4b44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44) #25 0x212b68e (/home/i74700deb64/blender/__work__/build_cmake_dbg/bin/blender+0x212b68e) 0x000008fe3c9e is located 0 bytes to the right of global variable '__PRETTY_FUNCTION__' from '/home/i74700deb64/blender/__work__/src/extern/libmv/third_party/ceres/internal/ceres/generated/partitioned_matrix_view_2_4_3.cc' (0x8fe3a80) of size 542 '__PRETTY_FUNCTION__' is ascii string 'Eigen::CoeffBasedProduct<Lhs, Rhs, NestingFlags>::CoeffBasedProduct(const Lhs&, const Rhs&) [with Lhs = Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; Rhs = Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; LhsNested = const Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; RhsNested = const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; int NestingFlags = 6]' 0x000008fe3c9e is located 34 bytes to the left of global variable '__PRETTY_FUNCTION__' from '/home/i74700deb64/blender/__work__/src/extern/libmv/third_party/ceres/internal/ceres/generated/partitioned_matrix_view_2_4_3.cc' (0x8fe3cc0) of size 544 '__PRETTY_FUNCTION__' is ascii string 'Eigen::CoeffBasedProduct<Lhs, Rhs, NestingFlags>::CoeffBasedProduct(const Lhs&, const Rhs&) [with Lhs = Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; Rhs = Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; LhsNested = const Eigen::Transpose<const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> > >; RhsNested = const Eigen::Map<const Eigen::Matrix<double, 2, 3, 1, 2, 3>, 0, Eigen::Stride<0, 0> >; int NestingFlags = 256]' SUMMARY: AddressSanitizer: global-buffer-overflow ??:0 ?? Shadow bytes around the buggy address: 0x0000811f4740: 00 00 00 00 00 00 00 00 00 06 f9 f9 f9 f9 f9 f9 0x0000811f4750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f4760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f4770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f4780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0000811f4790: 00 00 00[06]f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x0000811f47a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f47b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f47c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0000811f47d0: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 0x0000811f47e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==22007==ABORTING ``` Looks like some pointer in the file has ugly bad value?

Zauber Paracelsus commented

2015-01-17 01:05:45 +01:00

I don't think the problem is so much the file, but rather it may be some kind of mishandling with weight painting or deformation? The crash occurs after I transferred weights from one model to the problem model. But when I instead just created the DEF-head group and then set it to 100% on all vertices, there were no problems.

Zauber Paracelsus commented

2015-01-17 01:18:42 +01:00

Okay, I've made another repro file. This one does not produce the crash, but rather sets the stage for the trigger conditions. For this I have used a different model off of blendswap, since I do not yet intend for the character models to be available in public.

File: NoseScalesCrashTest.blend
Repro: Open the file. The blend will be in Weight Paint mode. Go to the left and press Transfer Weights. From there, you have two ways to trigger the crash:

Make some quick random change or select an object, then press CTRL-Z to undo.
Save the file (preferably a copy), then try to reload it.

Okay, I've made another repro file. This one does not produce the crash, but rather sets the stage for the trigger conditions. For this I have used a different model off of blendswap, since I do not yet intend for the character models to be available in public. **File:** [NoseScalesCrashTest.blend](https://archive.blender.org/developer/F137576/NoseScalesCrashTest.blend) **Repro:** Open the file. The blend will be in Weight Paint mode. Go to the left and press Transfer Weights. From there, you have two ways to trigger the crash: 1) Make some quick random change or select an object, then press CTRL-Z to undo. 2) Save the file (preferably a copy), then try to reload it.

Sergey Sharybin commented

2015-01-17 10:10:37 +01:00

The file is corrupted beyond repairable state. We can not fix anything in blender in order to support this file working, But we should fix bug which lead to such a corrupted file.

For this we need exact steps of reproducing such a corrupted file from totally correct one.

The file is corrupted beyond repairable state. We can not fix anything in blender in order to support this file working, But we should fix bug which lead to such a corrupted file. For this we need exact steps of reproducing such a corrupted file from totally correct one.

Zauber Paracelsus commented

2015-01-17 14:58:34 +01:00

@Sergey: Check my previous comment, before yours.

Sergey Sharybin commented

2015-01-17 15:38:21 +01:00

@ZauberParacelsus, save and reload makes no changes to internal data structures. Same applies to selection and undo. So the file is still somewhat corrupted and not good for tracking down actual bug.

So your comment before mine doesn't actually help.

@ZauberParacelsus, save and reload makes no changes to internal data structures. Same applies to selection and undo. So the file is still somewhat corrupted and not good for tracking down actual bug. So your comment before mine doesn't actually help.

Zauber Paracelsus commented

2015-01-17 15:57:09 +01:00

Actually, I should point out that the problem begins with using the Transfer Weights function in weight painting mode.

Furthermore, I should clarify that I've been using a development build of Blender, where the Transfer Weights function appears to have been overhauled.

I'm betting that I ran into a new bug introduced in the Transfer Weights function, especially since the crash/corruption issue does not occur when I use the 2.73 release build.

Actually, I should point out that the problem begins with using the Transfer Weights function in weight painting mode. Furthermore, I should clarify that I've been using a development build of Blender, where the Transfer Weights function appears to have been overhauled. I'm betting that I ran into a new bug introduced in the Transfer Weights function, especially since the crash/corruption issue does **not** occur when I use the 2.73 release build.

Bastien Montagne self-assigned this 2015-01-17 15:59:35 +01:00

Bastien Montagne commented

2015-01-17 15:59:35 +01:00

Eeeeeeh, that’s a whole other topic!

Checking...

Eeeeeeh, that’s a whole other topic! Checking...

Zauber Paracelsus commented

2015-01-17 16:01:28 +01:00

Further testing, and with new repro steps. It'll occur on ANYTHING you use Transfer Weights on.

New repro steps:

Create a new scene, using a development build of blender.
Create two cubes near one another
On one cube, add a single vertex group and assign weights.
Select the first cube, then shift-select the other cube.
Go into Weight Painting mode
Use the Transfer Weights function
Save, and then reopen the file.

Further testing, and with new repro steps. It'll occur on ANYTHING you use Transfer Weights on. New repro steps: 1) Create a new scene, using a development build of blender. 2) Create two cubes near one another 3) On one cube, add a single vertex group and assign weights. 4) Select the first cube, then shift-select the other cube. 5) Go into Weight Painting mode 6) Use the Transfer Weights function 7) Save, and then reopen the file.

blender-admin commented

2015-01-17 17:42:45 +01:00

This issue was referenced by 119ff676e1

This issue was referenced by 119ff676e1b348a66e33cd857089e78a5195a3c5

Bastien Montagne commented

2015-01-17 17:45:05 +01:00

Changed status from 'Open' to: 'Resolved'

Bastien Montagne closed this issue

2015-01-17 17:45:05 +01:00

Bastien Montagne commented

2015-01-17 17:45:05 +01:00

Closed by commit 119ff676e1.

Closed by commit 119ff676e1.

Zauber Paracelsus commented

2015-01-18 16:59:23 +01:00

@mont29: I just freshly compiled blender from git this morning. The crash no longer occurs with the original model(s) I discovered it on. However, it continues to occur with a slight variation on the repro steps I posted above:

Create a new scene, using a development build of blender.
Create two cubes near one another
On one cube, add a single vertex group and assign weights.
Select the first cube, then shift-select the other cube.
Go into Weight Painting mode
Use the Transfer Weights function
Select any other object, then hit CTRL-Z

Further, it seems like it will only crash sometimes on a bad saved file, but doing step 7 above on that file repros a crash, as will attempting to Transfer Weights again, or trying to remove a vertex group. In fact, every other thing I do on that file, even something as innocuous as entering edit mode, will trigger a crash. So, perhaps there is an unfixed code path that still has the issue?

@mont29: I just freshly compiled blender from git this morning. The crash no longer occurs with the original model(s) I discovered it on. However, it continues to occur with a slight variation on the repro steps I posted above: 1. Create a new scene, using a development build of blender. 2. Create two cubes near one another 3. On one cube, add a single vertex group and assign weights. 4. Select the first cube, then shift-select the other cube. 5. Go into Weight Painting mode 6. Use the Transfer Weights function 7. Select any other object, then hit CTRL-Z Further, it seems like it will only crash *sometimes* on a bad saved file, but doing step 7 above on that file repros a crash, as will attempting to Transfer Weights again, or trying to remove a vertex group. In fact, every other thing I do on that file, even something as innocuous as entering edit mode, will trigger a crash. So, perhaps there is an unfixed code path that still has the issue?

Bastien Montagne commented

2015-01-18 17:39:59 +01:00

@ZauberParacelsus cannot reproduce following steps you gave here… Unless you mean, you are still using a corrupted file? in this case, yes, even in a new scene issue will remain, but starting from scratch with startup file I get absolutely no crash here.

Zauber Paracelsus commented

2015-01-18 17:51:02 +01:00

Issue repros on my build from just a couple hours ago that was compiled fresh off of git. However, the issue does not repro at all on the nightly I just downloaded.

Very weird :-/

Issue repros on my build from just a couple hours ago that was compiled fresh off of git. However, the issue does not repro at all on the nightly I just downloaded. Very weird :-/

Bastien Montagne commented

2015-01-18 18:01:20 +01:00

what’s the hash shown on blender startup panel?

Zauber Paracelsus commented

2015-01-18 18:06:17 +01:00

For the nightly, the hash is 6e97db7. For the build I compiled myself (where the issue still repros partially), there is no hash. This is the output from git on the command line:

[zauber@manjaro blender]$ git describe --tags
v2.73-rc1-328-gecc58da
[zauber@manjaro blender]$ git rev-parse HEAD
ecc58da8f1d110498e700b804cb44adba1145113

For the nightly, the hash is 6e97db7. For the build I compiled myself (where the issue still repros partially), there is no hash. This is the output from git on the command line: ``` [zauber@manjaro blender]$ git describe --tags v2.73-rc1-328-gecc58da [zauber@manjaro blender]$ git rev-parse HEAD ecc58da8f1d110498e700b804cb44adba1145113 ```

Bastien Montagne commented

2015-01-18 18:23:23 +01:00

That is pretty much exactly the same code… no reason to have that difference in behavior.

Maybe make a full rebuild (make clean, then usual build command)?

That is pretty much exactly the same code… no reason to have that difference in behavior. Maybe make a full rebuild (make clean, then usual build command)?

Zauber Paracelsus commented

2015-01-20 16:18:48 +01:00

Deleted my blender source directory entirely, and redownloaded everything from git so that I had a clean slate. Issue no longer repros.

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash Upon Opening File #43283