Segfault when switching brushes while renaming another brush #49023

New Issue

Joshua Leung · 2016-08-05T16:39:35+02:00

Joshua Leung commented

2016-08-05 16:39:35 +02:00

System Information
Windows 64-bit, msvc2013

Blender Version
Broken: 357480f8c3

Short description of error

Draw a single stroke
Resize the Toolshelf so that the full name for "Ink noise" can be seen
Double-click on the "Pencil" brush to start renaming it
Click on the middle of the "Ink" name label

At this point, it sometimes crashes, and sometimes doesn't.

Sometimes, if I keep clicking on the Ink label, one of those times it will crash. (But it will take a good 7-10 attempts for that to happen)
Sometimes, if I resize the toolshelf a little bit again, and try again it will crash.
Sometimes, if I select another brush (e.g. the first one) instead, it will crash.
Sometimes, I can't reproduce this at all.

**System Information** Windows 64-bit, msvc2013 **Blender Version** Broken: 357480f8c3 **Short description of error** 1. Draw a single stroke 2. Resize the Toolshelf so that the full name for "Ink noise" can be seen 3. Double-click on the "Pencil" brush to start renaming it 4. Click on the middle of the "Ink" name label At this point, it sometimes crashes, and sometimes doesn't. - Sometimes, if I keep clicking on the Ink label, one of those times it will crash. (But it will take a good 7-10 attempts for that to happen) - Sometimes, if I resize the toolshelf a little bit again, and try again it will crash. - Sometimes, if I select another brush (e.g. the first one) instead, it will crash. - Sometimes, I can't reproduce this at all.

Antonio Vazquez was assigned by Joshua Leung

2016-08-05 16:39:36 +02:00

Joshua Leung commented

2016-08-05 16:39:36 +02:00

Changed status to: 'Open'

Joshua Leung commented

2016-08-05 16:39:36 +02:00

Added subscriber: @JoshuaLeung

Joshua Leung commented

2016-08-05 16:41:02 +02:00

@antoniov: Could you take a look to figure out what's going on here? It might be something subtle going wrong with the RNA set functions for the brush names.

Antonio Vazquez commented

2016-08-05 18:34:07 +02:00

I cannot reproduce (I'm running Windows 10 64bits) the error.

Are you using buildbot version or compile yourself (I see MSVS2013 in your comment)
You describe the error when resize, and this is not related to rename the brush but UI.

@JoshuaLeung The RNA code is very simple in RNA_scene.c, so I don't think this is the problem.

I cannot reproduce (I'm running Windows 10 64bits) the error. * Are you using buildbot version or compile yourself (I see MSVS2013 in your comment) * You describe the error when resize, and this is not related to rename the brush but UI. @JoshuaLeung The RNA code is very simple in RNA_scene.c, so I don't think this is the problem.

Antonio Vazquez commented

2016-08-05 19:06:04 +02:00

@JoshuaLeung After a lot of test, I got this:

backtrace

33: BLI_system_backtrace - 0xCF94EC0
32: sig_handle_crash_backtrace - 0xBC5FCB0
31: sig_handle_crash - 0xBC5FD00
30: windows_exception_handler - 0xBC5FF80
29: UnhandledExceptionFilter - 0x6AFF7C70
28: memset - 0x6E51B900
27: _C_specific_handler - 0x6E505A90
26: _chkstk - 0x6E519A00
25: RtlImageNtHeaderEx - 0x6E4A4B30
24: KiUserExceptionDispatcher - 0x6E518BD0
23: strcmp - 0x10365B00
22: uniquename_find_dupe - 0xCF9CFC0
21: uniquename_unique_check - 0xCF9D060
20: BLI_uniquename_cb - 0xCF9ACD0
19: BLI_uniquename - 0xCF9ABD0
18: rna_GPencilBrush_name_set - 0xCCB56D0
17: GPencilBrush_name_set - 0xCCC3950
16: RNA_property_string_set - 0xCC65060
15: ui_but_string_set - 0xBF93420
14: ui_apply_but_TEX - 0xBFB8840
13: ui_apply_but - 0xBFBAF90
12: button_activate_exit - 0xBFB68F0
11: ui_handle_button_event - 0xBFCEC70
10: ui_handler_region_menu - 0xBFB6DF0
9: wm_handler_ui_call - 0xBC7AC80
8: wm_handlers_do_intern - 0xBC7DAF0
7: wm_handlers_do - 0xBC7E170
6: wm_event_do_handlers - 0xBC787C0
5: WM_main - 0xBC609E0
4: main - 0xBC59580
3: __tmainCRTStartup - 0x1036B900
2: mainCRTStartup - 0x1036BB20
1: BaseThreadInitThunk - 0x6D6480E0
0: RtlUserThreadStart - 0x6E4CC580

You can see the problem is in unique name function

The RNA set of brushes name is equal to layers name, so I don't see why we get this error.

@JoshuaLeung After a lot of test, I got this: # backtrace 33: BLI_system_backtrace - 0xCF94EC0 32: sig_handle_crash_backtrace - 0xBC5FCB0 31: sig_handle_crash - 0xBC5FD00 30: windows_exception_handler - 0xBC5FF80 29: UnhandledExceptionFilter - 0x6AFF7C70 28: memset - 0x6E51B900 27: _C_specific_handler - 0x6E505A90 26: _chkstk - 0x6E519A00 25: RtlImageNtHeaderEx - 0x6E4A4B30 24: KiUserExceptionDispatcher - 0x6E518BD0 23: strcmp - 0x10365B00 22: uniquename_find_dupe - 0xCF9CFC0 21: uniquename_unique_check - 0xCF9D060 20: BLI_uniquename_cb - 0xCF9ACD0 19: BLI_uniquename - 0xCF9ABD0 18: rna_GPencilBrush_name_set - 0xCCB56D0 17: GPencilBrush_name_set - 0xCCC3950 16: RNA_property_string_set - 0xCC65060 15: ui_but_string_set - 0xBF93420 14: ui_apply_but_TEX - 0xBFB8840 13: ui_apply_but - 0xBFBAF90 12: button_activate_exit - 0xBFB68F0 11: ui_handle_button_event - 0xBFCEC70 10: ui_handler_region_menu - 0xBFB6DF0 9: wm_handler_ui_call - 0xBC7AC80 8: wm_handlers_do_intern - 0xBC7DAF0 7: wm_handlers_do - 0xBC7E170 6: wm_event_do_handlers - 0xBC787C0 5: WM_main - 0xBC609E0 4: main - 0xBC59580 3: __tmainCRTStartup - 0x1036B900 2: mainCRTStartup - 0x1036BB20 1: BaseThreadInitThunk - 0x6D6480E0 0: RtlUserThreadStart - 0x6E4CC580 You can see the problem is in unique name function The RNA set of brushes name is equal to layers name, so I don't see why we get this error.

Bastien Montagne commented

2016-08-05 22:54:23 +02:00

Added subscriber: @mont29

Bastien Montagne commented

2016-08-05 22:54:23 +02:00

I can easily reproduce on linux with debug build + asan, will investigate (simpler to check when you can reproduce 100% of time ;) ).

blender-admin commented

2016-08-05 23:33:22 +02:00

This issue was referenced by df7be61438

This issue was referenced by df7be614382ba6ce58a2fab4ff6b4ab0b09b0a9f

Bastien Montagne commented

2016-08-05 23:37:11 +02:00

Changed status from 'Open' to: 'Resolved'

Bastien Montagne closed this issue

2016-08-05 23:37:11 +02:00

Antonio Vazquez commented

2016-08-06 11:05:32 +02:00

@mont29 I'm new to RNA code, so I'm not sure, but there are more lines in the same file using the same code that you fixed (51, 516, 524, 534, ...).

Is it necessary to replace all of them?

@mont29 I'm new to RNA code, so I'm not sure, but there are more lines in the same file using the same code that you fixed (51, 516, 524, 534, ...). Is it necessary to replace all of them?

Antonio Vazquez commented

2016-08-06 11:15:41 +02:00

I previous message I mean, similar code not equal. It is not clear for me the use of ptr->data yet :-)

Bastien Montagne commented

2016-08-06 11:16:49 +02:00

@antoniov I did quick check while fixing, and no, those do not need same change.

Reason is, rna_GPencil_active_brush_xxx and rna_GPencilBrush_index_xxx are callbacks of properties of an RNA struct defining RNA_def_struct_sdna(srna, "ToolSettings");, which means they'll get a ToolSettings as ptr->data.
On the other hand, rna_GPencilBrush_name_set is callback of a property of an RNA struct defining RNA_def_struct_sdna(srna, "bGPDbrush");, so it’ll get a bGPDbrush as ptr->data.

In later case, you can luckily find 'parent' struct pointer from ID owner (Scene here), which is stored in ptr->id.data.

Note that the code was pretty obviously broken though, same pointer being assigned as both toolsettings and gpdbrush… ;)

PS: just realized names of ``rna_GPencil_active_brush_xxxandrna_GPencilBrush_index_xxx` are 'wrong' (misleading), will fix that.

@antoniov I did quick check while fixing, and no, those do not need same change. Reason is, `rna_GPencil_active_brush_xxx` and `rna_GPencilBrush_index_xxx` are callbacks of properties of an RNA struct defining `RNA_def_struct_sdna(srna, "ToolSettings");`, which means they'll get a `ToolSettings` as `ptr->data`. On the other hand, `rna_GPencilBrush_name_set` is callback of a property of an RNA struct defining `RNA_def_struct_sdna(srna, "bGPDbrush");`, so it’ll get a `bGPDbrush` as `ptr->data`. In later case, you can luckily find 'parent' struct pointer from ID owner (Scene here), which is stored in `ptr->id.data`. Note that the code was pretty obviously broken though, same pointer being assigned as both toolsettings and gpdbrush… ;) PS: just realized names of ``rna_GPencil_active_brush_xxx` and `rna_GPencilBrush_index_xxx` are 'wrong' (misleading), will fix that.

Antonio Vazquez commented

2016-08-06 11:27:27 +02:00

Thnks for the explanation. After reading your comments I see the error was obvious.

Bastien Montagne commented

2016-08-06 11:27:51 +02:00

Also, noted a [+ reason/effect of using higher values of this property] in tooltip of pen_smooth_steps, this looks like TODO note more than understandable tip to me? ;)

Also, noted a `[+ reason/effect of using higher values of this property]` in tooltip of pen_smooth_steps, this looks like TODO note more than understandable tip to me? ;)

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Segfault when switching brushes while renaming another brush #49023

backtrace