Page MenuHome

Advance Timeline 1 frame past movie sequence of JPG's and crash. PNG's are fine.
Closed, ResolvedPublic

Description

System Information
OSX 10.10.3
ATI Radeon HD 2400 XT 128 MB
2.4 GHz Intel Core 2 Duo
4 GB 667 MHz DDR2 SDRAM

Blender Version
Broken: (example: 2.7.4 0287b39) (today's version, was doing this a week ago too)
Worked: Not sure.

Advance timeline from 2 to 3 (there is no 3) and crashes for JPG's but not PNG's.

Exact steps for others to reproduce the error

  1. Open zip file of two JPG's put into folder.
  2. Open .Blend , go to Compositing nodes.
  3. Open Movie clip, navigate to two JPG's
  4. On timeline, Hit |< to go to first frame, then advance to frame two , then frame three, - crash

Does not do this with PNG's.

Attached .blend, two JPG's, crash report.

Details

Type
Bug

Event Timeline

Joel Godin (FloridaJo) set Type to Bug.
Joel Godin (FloridaJo) created this task.
Joel Godin (FloridaJo) raised the priority of this task from to Needs Triage by Developer.

I cannot reproduce this here on Linux with latest master… Not even in debug build with asan.

Thomas, Jens, can you please try to confirm the issue? I would not expect that kind of bug to be platform-dependent, but who knows?

I confirm crash with same report on my MacPro/AMD

Looking into it ....

Jens

Julian Eisel (Severin) triaged this task as Confirmed, Medium priority.

Changing to confirmed and assigning to @jens verwiebe (jensverwiebe) then

Crashpoint is here:

  • frame #4: 0x0000000101711aca blender`MEM_CacheLimiter<MEM_CacheLimiterHandleCClass>::unmanage(this=0x0000628000088938, handle=0x000061800002a660) + 138 at MEM_CacheLimiter.h:166 frame #5: 0x0000000101710b54 blender`MEM_CacheLimiterHandle<MEM_CacheLimiterHandleCClass>::unmanage(this=0x000061800002a660) + 36 at MEM_CacheLimiter.h:121 frame #6: 0x000000010171043d blender`MEM_CacheLimiter_unmanage(handle=0x000061800002a660) + 29 at MEM_CacheLimiterC-Api.cpp:184 frame #7: 0x000000010142ec0e blender`moviecache_valfree(val=0x000000011b3b4a10) + 62 at moviecache.c:132

blender(7082,0x1118d8300) malloc: *** error for object 0x61800002a660: pointer being freed was not allocated

Jens

2.74 release is working okay with testconditions

Ah, with --debug-memory could reproduce the issue, here is asan report:

1==32423==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030001816d0 at pc 0x4f061c9 bp 0x7ffe22e59390 sp 0x7ffe22e59388
2READ of size 8 at 0x6030001816d0 thread T0
3 #0 0x4f061c8 in MEM_CacheLimiterHandle<MEM_CacheLimiterHandleCClass>::unmanage() /home/i74700deb64/blender/__work__/src/intern/memutil/MEM_CacheLimiter.h:121
4 #1 0x4f0546c in MEM_CacheLimiter_unmanage /home/i74700deb64/blender/__work__/src/intern/memutil/intern/MEM_CacheLimiterC-Api.cpp:184
5 #2 0x49ba729 in moviecache_valfree /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:132
6 #3 0x4a1ecf3 in ghash_insert_safe /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/BLI_ghash.c:501
7 #4 0x4a1ecf3 in BLI_ghash_reinsert /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/BLI_ghash.c:693
8 #5 0x49bbc49 in do_moviecache_put /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:365
9 #6 0x49bbf7a in IMB_moviecache_put /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:394
10 #7 0x3feab87 in imagecache_put /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:162
11 #8 0x3fec4ea in image_assign_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:407
12 #9 0x400101f in image_acquire_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:3915
13 #10 0x40011b7 in BKE_image_acquire_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:3945
14 #11 0x2309f81 in draw_nodespace_back_pix /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/drawnode.c:3176
15 #12 0x2318a98 in drawnodespace /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/node_draw.c:1347
16 #13 0x23434ae in node_main_area_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/space_node.c:660
17 #14 0x2e8b677 in ED_region_do_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/screen/area.c:480
18 #15 0x2197818 in wm_method_draw_triple /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:640
19 #16 0x2199ec4 in wm_draw_update /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:1047
20 #17 0x218b093 in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:493
21 #18 0x2188dc5 in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1865
22 #19 0x7fb60f5afb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
23 #20 0x21836ae (/home/i74700deb64/blender/__work__/build_cmake_dbg/bin/blender+0x21836ae)
24
250x6030001816d0 is located 16 bytes inside of 24-byte region [0x6030001816c0,0x6030001816d8)
26freed by thread T48 here:
27 #0 0x7fb6157dc477 in operator delete(void*) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x55477)
28 #1 0x4f0715d in MEM_CacheLimiter<MEM_CacheLimiterHandleCClass>::unmanage(MEM_CacheLimiterHandle<MEM_CacheLimiterHandleCClass>*) /home/i74700deb64/blender/__work__/src/intern/memutil/MEM_CacheLimiter.h:166
29 #2 0x4f061df in MEM_CacheLimiterHandle<MEM_CacheLimiterHandleCClass>::unmanage() /home/i74700deb64/blender/__work__/src/intern/memutil/MEM_CacheLimiter.h:121
30 #3 0x4f0546c in MEM_CacheLimiter_unmanage /home/i74700deb64/blender/__work__/src/intern/memutil/intern/MEM_CacheLimiterC-Api.cpp:184
31 #4 0x49ba729 in moviecache_valfree /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:132
32 #5 0x4a1dadc in ghash_free_cb /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/BLI_ghash.c:574
33 #6 0x4a20962 in BLI_ghash_free /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/BLI_ghash.c:860
34 #7 0x49bc3f4 in IMB_moviecache_free /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:458
35 #8 0x3feba43 in image_free_cached_frames /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:261
36 #9 0x3ff794b in BKE_image_verify_viewer_views /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:2426
37 #10 0x3ce1c66 in ViewerOperation::initImage() /home/i74700deb64/blender/__work__/src/source/blender/compositor/operations/COM_ViewerOperation.cpp:135
38 #11 0x3ce1259 in ViewerOperation::initExecution() /home/i74700deb64/blender/__work__/src/source/blender/compositor/operations/COM_ViewerOperation.cpp:74
39 #12 0x3c342a7 in ExecutionSystem::execute() /home/i74700deb64/blender/__work__/src/source/blender/compositor/intern/COM_ExecutionSystem.cpp:168
40 #13 0x3c32e7b in COM_execute /home/i74700deb64/blender/__work__/src/source/blender/compositor/intern/COM_compositor.cpp:100
41 #14 0x44088d4 in ntreeCompositExecTree /home/i74700deb64/blender/__work__/src/source/blender/nodes/composite/node_composite_tree.c:233
42 #15 0x231a063 in compo_startjob /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/node_edit.c:243
43 #16 0x21ba78b in do_job_thread /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_jobs.c:328
44 #17 0x4b20763 in tslot_thread_start /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:252
45 #18 0x7fb613cc10a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)
46
47previously allocated by thread T39 here:
48 #0 0x7fb6157dbfff in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54fff)
49 #1 0x4f05b72 in MEM_CacheLimiter<MEM_CacheLimiterHandleCClass>::insert(MEM_CacheLimiterHandleCClass*) /home/i74700deb64/blender/__work__/src/intern/memutil/MEM_CacheLimiter.h:156
50 #2 0x4f04fcf in MEM_CacheLimiterCClass::insert(void*) /home/i74700deb64/blender/__work__/src/intern/memutil/intern/MEM_CacheLimiterC-Api.cpp:123
51 #3 0x4f05420 in MEM_CacheLimiter_insert /home/i74700deb64/blender/__work__/src/intern/memutil/intern/MEM_CacheLimiterC-Api.cpp:174
52 #4 0x49bbdfe in do_moviecache_put /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:374
53 #5 0x49bbf7a in IMB_moviecache_put /home/i74700deb64/blender/__work__/src/source/blender/imbuf/intern/moviecache.c:394
54 #6 0x3feab87 in imagecache_put /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:162
55 #7 0x3fec4ea in image_assign_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:407
56 #8 0x400101f in image_acquire_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:3915
57 #9 0x40011b7 in BKE_image_acquire_ibuf /home/i74700deb64/blender/__work__/src/source/blender/blenkernel/intern/image.c:3945
58 #10 0x3ce1d03 in ViewerOperation::initImage() /home/i74700deb64/blender/__work__/src/source/blender/compositor/operations/COM_ViewerOperation.cpp:140
59 #11 0x3ce1259 in ViewerOperation::initExecution() /home/i74700deb64/blender/__work__/src/source/blender/compositor/operations/COM_ViewerOperation.cpp:74
60 #12 0x3c342a7 in ExecutionSystem::execute() /home/i74700deb64/blender/__work__/src/source/blender/compositor/intern/COM_ExecutionSystem.cpp:168
61 #13 0x3c32e7b in COM_execute /home/i74700deb64/blender/__work__/src/source/blender/compositor/intern/COM_compositor.cpp:100
62 #14 0x44088d4 in ntreeCompositExecTree /home/i74700deb64/blender/__work__/src/source/blender/nodes/composite/node_composite_tree.c:233
63 #15 0x231a063 in compo_startjob /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/node_edit.c:243
64 #16 0x21ba78b in do_job_thread /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_jobs.c:328
65 #17 0x4b20763 in tslot_thread_start /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:252
66 #18 0x7fb613cc10a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x80a3)
67
68Thread T48 created by T0 here:
69 #0 0x7fb6157aabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
70 #1 0x4b2086f in BLI_insert_thread /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:268
71 #2 0x21baf15 in WM_jobs_start /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_jobs.c:411
72 #3 0x231a4bc in ED_node_composite_job /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/node_edit.c:296
73 #4 0x2342b86 in node_area_refresh /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/space_node.c:556
74 #5 0x2e87f17 in ED_area_do_refresh /home/i74700deb64/blender/__work__/src/source/blender/editors/screen/area.c:149
75 #6 0x219ca3c in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:364
76 #7 0x218b087 in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:490
77 #8 0x2188dc5 in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1865
78 #9 0x7fb60f5afb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
79
80Thread T39 created by T0 here:
81 #0 0x7fb6157aabba in pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23bba)
82 #1 0x4b2086f in BLI_insert_thread /home/i74700deb64/blender/__work__/src/source/blender/blenlib/intern/threads.c:268
83 #2 0x21baf15 in WM_jobs_start /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_jobs.c:411
84 #3 0x231a4bc in ED_node_composite_job /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/node_edit.c:296
85 #4 0x2342b86 in node_area_refresh /home/i74700deb64/blender/__work__/src/source/blender/editors/space_node/space_node.c:556
86 #5 0x2e87f17 in ED_area_do_refresh /home/i74700deb64/blender/__work__/src/source/blender/editors/screen/area.c:149
87 #6 0x219ca3c in wm_event_do_notifiers /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_event_system.c:364
88 #7 0x218b087 in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:490
89 #8 0x2188dc5 in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:1865
90 #9 0x7fb60f5afb44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b44)
91
92SUMMARY: AddressSanitizer: heap-use-after-free /home/i74700deb64/blender/__work__/src/intern/memutil/MEM_CacheLimiter.h:121 MEM_CacheLimiterHandle<MEM_CacheLimiterHandleCClass>::unmanage()
93Shadow bytes around the buggy address:
94 0x0c0680028280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
95 0x0c0680028290: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
96 0x0c06800282a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
97 0x0c06800282b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
98 0x0c06800282c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
99=>0x0c06800282d0: fa fa 00 00 00 fa fa fa fd fd[fd]fa fa fa fa fa
100 0x0c06800282e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
101 0x0c06800282f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
102 0x0c0680028300: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
103 0x0c0680028310: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
104 0x0c0680028320: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
105Shadow byte legend (one shadow byte represents 8 application bytes):
106 Addressable: 00
107 Partially addressable: 01 02 03 04 05 06 07
108 Heap left redzone: fa
109 Heap right redzone: fb
110 Freed heap region: fd
111 Stack left redzone: f1
112 Stack mid redzone: f2
113 Stack right redzone: f3
114 Stack partial redzone: f4
115 Stack after return: f5
116 Stack use after scope: f8
117 Global redzone: f9
118 Global init order: f6
119 Poisoned by user: f7
120 Contiguous container OOB:fc
121 ASan internal: fe
122==32423==ABORTING

Tried to bisect that, but with limited success… crash first appears in rB4c2306d21a2a, and does not exists before rBd5f1b9c22233, so it’s clearly related to multiview somehow. Crash is not reproducible when multiview is enabled.

Dalai, think this one is for you?

Is it possible it has to do with the Alpha channel since it works okay with PNG, but not JPG?

@Bastien Montagne (mont29) do you still have this issue? Some fixes went in that may have fixed that.

Bastien Montagne (mont29) closed this task as Resolved.

@Dalai Felinto (dfelinto) No, impossible to reproduce anymore, think we can consider this as fixed as well. :)