2.8: Deleting a objects uses freed memory #51878

New Issue

Campbell Barton · 2017-06-23T10:23:23+02:00

Campbell Barton commented

2017-06-23 10:23:23 +02:00

With the attached file:

Delete all objects in scene (a, a, x, Enter), then switch to "Scene" and do it again. This crashes ASAN with error:

=================================================================
==7967==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b0000604a8 at pc 0x000001e6080b bp 0x7ffd6af36270 sp 0x7ffd6af36260
READ of size 2 at 0x61b0000604a8 thread T0
    - 0 0x1e6080a in ED_render_id_flush_update /src/blender/source/blender/editors/render/render_update.c:552
    - 1 0x48a9363 in DEG::deg_editors_id_update(Main*, ID*) /src/blender/source/blender/depsgraph/intern/depsgraph.cc:423
    - 2 0x49185e6 in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:146
    - 3 0x48b5f81 in DEG_ids_flush_tagged /src/blender/source/blender/depsgraph/intern/depsgraph_tag.cc:302
    - 4 0x3b24964 in BKE_scene_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1520
    - 5 0x96a89c in wm_event_do_notifiers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:433
    - 6 0x94d9a1 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:509
    - 7 0x940d60 in main /src/blender/source/creator/creator.c:526
    - 8 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439)
    - 9 0x93ff39 in _start (/src/cmake_debug/bin/blender+0x93ff39)

0x61b0000604a8 is located 40 bytes inside of 1512-byte region [0x61b000060480,0x61b000060a68)
freed by thread T0 here:
    - 0 0x7f2eebc394c8 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:45
    - 1 0x49e81dc in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:169
    - 2 0x37db7a4 in BKE_libblock_free_ex /src/blender/source/blender/blenkernel/intern/library_remap.c:922
    - 3 0x37db7fc in BKE_libblock_free /src/blender/source/blender/blenkernel/intern/library_remap.c:927
    - 4 0x37dba34 in BKE_libblock_free_us /src/blender/source/blender/blenkernel/intern/library_remap.c:950
    - 5 0x34bc3fd in BKE_collection_object_remove /src/blender/source/blender/blenkernel/intern/collection.c:290
    - 6 0x34bc5a7 in BKE_collections_object_remove /src/blender/source/blender/blenkernel/intern/collection.c:315
    - 7 0x1badf63 in ED_base_object_free_and_unlink /src/blender/source/blender/editors/object/object_add.c:1215
    - 8 0x1bae88a in object_delete_exec /src/blender/source/blender/editors/object/object_add.c:1271
    - 9 0x971709 in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1154
    - 10 0x972a94 in wm_operator_call_internal /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1339
    - 11 0x972d36 in WM_operator_name_call_ptr /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1387
    - 12 0x167b3f5 in ui_apply_but_funcs_after /src/blender/source/blender/editors/interface/interface_handlers.c:796
    - 13 0x16e8ac0 in ui_popup_handler /src/blender/source/blender/editors/interface/interface_handlers.c:10174
    - 14 0x96afb1 in wm_handler_ui_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:480
    - 15 0x97940d in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2106
    - 16 0x97a88c in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2255
    - 17 0x97cd4c in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2539
    - 18 0x94d995 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:506
    - 19 0x940d60 in main /src/blender/source/creator/creator.c:526
    #20 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439)

previously allocated by thread T0 here:
    - 0 0x7f2eebc39860 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:62
    - 1 0x49e8aad in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:307
    - 2 0x319786b in read_struct /src/blender/source/blender/blenloader/intern/readfile.c:1903
    - 3 0x31f7d27 in read_libblock /src/blender/source/blender/blenloader/intern/readfile.c:8408
    - 4 0x31fcd64 in blo_read_file_internal /src/blender/source/blender/blenloader/intern/readfile.c:8899
    - 5 0x318479b in BLO_read_from_file /src/blender/source/blender/blenloader/intern/readblenentry.c:331
    - 6 0x3415d4c in BKE_blendfile_read /src/blender/source/blender/blenkernel/intern/blendfile.c:381
    - 7 0x98a50f in WM_file_read /src/blender/source/blender/windowmanager/intern/wm_files.c:569
    - 8 0x9923d2 in wm_file_read_opwrap /src/blender/source/blender/windowmanager/intern/wm_files.c:1704
    - 9 0x992a98 in wm_open_mainfile_exec /src/blender/source/blender/windowmanager/intern/wm_files.c:1763
    - 10 0x97722b in wm_handler_fileselect_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1901
    - 11 0x978398 in wm_handler_fileselect_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1988
    - 12 0x979529 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2112
    - 13 0x97a88c in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2255
    - 14 0x97d5cb in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2632
    - 15 0x94d995 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:506
    - 16 0x940d60 in main /src/blender/source/creator/creator.c:526
    - 17 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439)

SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/editors/render/render_update.c:552 in ED_render_id_flush_update
Shadow bytes around the buggy address:
  0x0c3680004040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680004050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680004060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680004070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c3680004080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3680004090: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c36800040a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c36800040b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c36800040c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c36800040d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c36800040e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==7967==ABORTING

With the attached file: [delete_scene_crash.blend](https://archive.blender.org/developer/F639700/delete_scene_crash.blend) Delete all objects in scene (a, a, x, Enter), then switch to "Scene" and do it again. This crashes ASAN with error: ``` ================================================================= ==7967==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b0000604a8 at pc 0x000001e6080b bp 0x7ffd6af36270 sp 0x7ffd6af36260 READ of size 2 at 0x61b0000604a8 thread T0 - 0 0x1e6080a in ED_render_id_flush_update /src/blender/source/blender/editors/render/render_update.c:552 - 1 0x48a9363 in DEG::deg_editors_id_update(Main*, ID*) /src/blender/source/blender/depsgraph/intern/depsgraph.cc:423 - 2 0x49185e6 in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:146 - 3 0x48b5f81 in DEG_ids_flush_tagged /src/blender/source/blender/depsgraph/intern/depsgraph_tag.cc:302 - 4 0x3b24964 in BKE_scene_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1520 - 5 0x96a89c in wm_event_do_notifiers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:433 - 6 0x94d9a1 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:509 - 7 0x940d60 in main /src/blender/source/creator/creator.c:526 - 8 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439) - 9 0x93ff39 in _start (/src/cmake_debug/bin/blender+0x93ff39) 0x61b0000604a8 is located 40 bytes inside of 1512-byte region [0x61b000060480,0x61b000060a68) freed by thread T0 here: - 0 0x7f2eebc394c8 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:45 - 1 0x49e81dc in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:169 - 2 0x37db7a4 in BKE_libblock_free_ex /src/blender/source/blender/blenkernel/intern/library_remap.c:922 - 3 0x37db7fc in BKE_libblock_free /src/blender/source/blender/blenkernel/intern/library_remap.c:927 - 4 0x37dba34 in BKE_libblock_free_us /src/blender/source/blender/blenkernel/intern/library_remap.c:950 - 5 0x34bc3fd in BKE_collection_object_remove /src/blender/source/blender/blenkernel/intern/collection.c:290 - 6 0x34bc5a7 in BKE_collections_object_remove /src/blender/source/blender/blenkernel/intern/collection.c:315 - 7 0x1badf63 in ED_base_object_free_and_unlink /src/blender/source/blender/editors/object/object_add.c:1215 - 8 0x1bae88a in object_delete_exec /src/blender/source/blender/editors/object/object_add.c:1271 - 9 0x971709 in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1154 - 10 0x972a94 in wm_operator_call_internal /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1339 - 11 0x972d36 in WM_operator_name_call_ptr /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1387 - 12 0x167b3f5 in ui_apply_but_funcs_after /src/blender/source/blender/editors/interface/interface_handlers.c:796 - 13 0x16e8ac0 in ui_popup_handler /src/blender/source/blender/editors/interface/interface_handlers.c:10174 - 14 0x96afb1 in wm_handler_ui_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:480 - 15 0x97940d in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2106 - 16 0x97a88c in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2255 - 17 0x97cd4c in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2539 - 18 0x94d995 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:506 - 19 0x940d60 in main /src/blender/source/creator/creator.c:526 #20 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439) previously allocated by thread T0 here: - 0 0x7f2eebc39860 in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:62 - 1 0x49e8aad in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:307 - 2 0x319786b in read_struct /src/blender/source/blender/blenloader/intern/readfile.c:1903 - 3 0x31f7d27 in read_libblock /src/blender/source/blender/blenloader/intern/readfile.c:8408 - 4 0x31fcd64 in blo_read_file_internal /src/blender/source/blender/blenloader/intern/readfile.c:8899 - 5 0x318479b in BLO_read_from_file /src/blender/source/blender/blenloader/intern/readblenentry.c:331 - 6 0x3415d4c in BKE_blendfile_read /src/blender/source/blender/blenkernel/intern/blendfile.c:381 - 7 0x98a50f in WM_file_read /src/blender/source/blender/windowmanager/intern/wm_files.c:569 - 8 0x9923d2 in wm_file_read_opwrap /src/blender/source/blender/windowmanager/intern/wm_files.c:1704 - 9 0x992a98 in wm_open_mainfile_exec /src/blender/source/blender/windowmanager/intern/wm_files.c:1763 - 10 0x97722b in wm_handler_fileselect_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1901 - 11 0x978398 in wm_handler_fileselect_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1988 - 12 0x979529 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2112 - 13 0x97a88c in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2255 - 14 0x97d5cb in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2632 - 15 0x94d995 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:506 - 16 0x940d60 in main /src/blender/source/creator/creator.c:526 - 17 0x7f2ee8ac3439 in __libc_start_main (/usr/lib/libc.so.6+0x20439) SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/editors/render/render_update.c:552 in ED_render_id_flush_update Shadow bytes around the buggy address: 0x0c3680004040: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680004050: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680004060: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680004070: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c3680004080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c3680004090: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x0c36800040a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c36800040b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c36800040c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c36800040d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c36800040e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==7967==ABORTING ```

Campbell Barton commented

2017-06-23 10:23:23 +02:00

Changed status to: 'Open'