Crash when removing second material slot from data-linked objects
Closed, ResolvedPublic

Description

System Information
Win7 64bit ATI HD4670

Blender Version
Broken: 2.79

Short description of error
If you Alt-D duplicate many objects and create second slot for material in one of them, then Blender will crash after atempting to remove it.

Exact steps for others to reproduce the error
Open file, remove second slot.

Related Objects

LazyDodo (LazyDodo) triaged this task as Confirmed priority.Sep 30 2017, 1:13 AM

id has a bogus pointer at

 	blender.exe!id_us_min(ID * id) Line 239	C
>	blender.exe!BKE_object_material_slot_remove(Object * ob) Line 1266	C
 	blender.exe!material_slot_remove_exec(bContext * C, wmOperator * op) Line 150	C
 	blender.exe!wm_operator_invoke(bContext * C, wmOperatorType * ot, wmEvent * event, PointerRNA * properties, ReportList * reports, const bool poll_only) Line 1151	C
 	blender.exe!wm_operator_call_internal(bContext * C, wmOperatorType * ot, PointerRNA * properties, ReportList * reports, const short context, const bool poll_only) Line 1336	C
 	blender.exe!WM_operator_name_call_ptr(bContext * C, wmOperatorType * ot, short context, PointerRNA * properties) Line 1385	C
 	blender.exe!ui_apply_but_funcs_after(bContext * C) Line 797	C
 	blender.exe!ui_handler_region_menu(bContext * C, const wmEvent * event, void * UNUSED_userdata) Line 10100	C
 	blender.exe!wm_handler_ui_call(bContext * C, wmEventHandler * handler, const wmEvent * event, int always_pass) Line 462	C
 	blender.exe!wm_handlers_do_intern(bContext * C, wmEvent * event, ListBase * handlers) Line 2100	C
 	blender.exe!wm_handlers_do(bContext * C, wmEvent * event, ListBase * handlers) Line 2184	C
 	blender.exe!wm_event_do_handlers(bContext * C) Line 2457	C
 	blender.exe!WM_main(bContext * C) Line 511	C
 	blender.exe!main(int argc, const unsigned char * * UNUSED_argv_c) Line 529	C

It must be buried somewhere in the code that handles the material link type (i.e. if it is set to 'OBJECT' or 'DATA'). In the given file, the material link is set to 'OBJECT'. If you set the link to 'DATA' on all cube instances, the slot can be removed without a crash. I have done that material link change in the file provided here:

It's the same file as in the initial bug report, just the link type has been changed. However, it is not sufficient to only do the change on one cube instance. In that case, the crash would still happen.

We're also using 'OBJECT' link type here in the studio a lot, so we rammed into a similar issue today. The 'solution' is identical. Hope this helps to track down the bug.

By simplifying the original file, I reduce them to 2 objects, and add another 2 objects for comparison.
In the attached file (test_case_2.blend), the left side 2 cubes, will cause crash. While the right side 2 cubes won't.
It would be helpful to know HOW those cubes are created ?

Comment: The crash was also happened on macOS, system information:

System Information
macOS 10.13.2

Blender Version
Broken: 2.79, 2.80(2017-11-25)

It doesn't crash with Data option, only Object

I changed the right side cubes to Object, then Alt-D to duplicate, after that, deleting does not crash.
While the left side cubes will.

So, I am curious about how did you create the left cubes ?

Please see the attached : test_case_3.blend{F1522174}

I did same thing, Alt-D cube with one Object material many times, than add another slot to one cube (others will not have second slot).

Here is yours altered file:

OK, we get some observations now:

  1. The same creating steps caused crash on Win7 is NOT happened on macOS.
  2. Those SAVED cubes from Win7, will crash on macOS.

There is a strange place in the code, it seems that the active current material index is not decremented (when it should be).
Attached is the patch, It only passed the crash test, not sure for that it is a correct fix, is there anybody can{F1586868} help to review?