Blender crash when enabling OpenSubdiv
Open, ConfirmedPublic

Description

Window 7 64-bit, GTX 770 OC

Hash: 29ec0b1 (Date: 2017-07-11)

When enabling OpenSubdiv, Blender just crashes with: [Error: EXCEPTION_ACCESS_VIOLATION] in the console
Steps to Reproduce: Open the included file, then enable [Use OpenSubdiv]

(note: model is nsfw/nude)

Sometimes it works by doing that but if you disable then re-enable OpenSubdiv a few times, it'll crash. It started (and often) crashing on my first try,
I think it crashes more frequently with new-depsgraph enabled but it also happens without it, so that's not a direct factor of the issue.

Details

Type
Bug
¿? (edtion) edited the task description. (Show Details)

Was crash log generated? Please upload if it does. Thanks.
https://docs.blender.org/manual/en/dev/troubleshooting/crash.html

Also, launch Blender from the command line with -d option and attach as text file here any error printed out in the console (do not paste it directly in comment).

I never get any crash logs; I'm not sure what -d is supposed to be doing but the only text I can apparently get comes from the command prompt, and since it gets too full to hold everything and doesn't auto-save anything, the text that I can select+copy is limited.
Unless I'm supposed to use it some other way. Here's the log before crash:

Here's the log when starting with -d (at least as much as I can get)

This time, it wouldn't crash whilst enabling/disabling OpenSubdiv, but it did after cycling through level 1-3 with it enabled.

Aaron Carlisle (Blendify) triaged this task as "Confirmed" priority.

Developer note

The issue is caused by some code in face-varying logic which doesn't handle special cases of non-manifold meshes correctly, causing reading past the array size. Here is a simplified file which demonstrates the issue:

.

The issue is visible on Linux when OSD is compiled with ASAN.

Not sure yet whether it's issue in how we order the loops when passing to OSD or if it's an issue on OSD side.