Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor is over the strip #54891

New Issue

Nathan Lovato · 2018-04-30T03:13:15+02:00

Nathan Lovato commented

2018-04-30 03:13:15 +02:00

System Information
Windows 10

Blender Version
Broken: Blender 2.79b

Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor overlaps the strip, so only when you're extending a video or an image strip.

It happens often but I can't reproduce the bug 100% of the time. Sometimes it'll insta crash with any strip, sometimes it'll work. Even on minimal projects, e.g. with only one video or image strip.

See attached blend

Select a video, image or audio strip linked to an effect strip
Place the time cursor so it overlaps the strip
Press E to extend the strip
Press Ctrl to snap, Blender crashes

Blend file:
time-extend-crash.zip

It's my first time reporting a bug here, please tell me if you need anything else or I should provide more/different info :)

**System Information** Windows 10 **Blender Version** Broken: Blender 2.79b ![image.png](https://archive.blender.org/developer/F3132761/image.png) Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor overlaps the strip, so only when you're extending a video or an image strip. It happens often but I can't reproduce the bug 100% of the time. Sometimes it'll insta crash with any strip, sometimes it'll work. Even on minimal projects, e.g. with only one video or image strip. See attached blend - Select a video, image or audio strip linked to an effect strip - Place the time cursor so it overlaps the strip - Press E to extend the strip - Press Ctrl to snap, Blender crashes Blend file: [time-extend-crash.zip](https://archive.blender.org/developer/F3133036/time-extend-crash.zip) *It's my first time reporting a bug here, please tell me if you need anything else or I should provide more/different info :)*

Nathan Lovato commented

2018-04-30 03:13:15 +02:00

Added subscriber: @GDQuest

ChristopherAnderssarian commented

2018-04-30 11:12:08 +02:00

Added subscriber: @ChristopherAnderssarian

ChristopherAnderssarian commented

2018-04-30 11:12:08 +02:00

Can confirm crash here.

Philipp Oeser commented

2018-04-30 13:02:10 +02:00

Added subscriber: @lichtwerk

Philipp Oeser self-assigned this 2018-04-30 13:02:10 +02:00

Philipp Oeser commented

2018-04-30 13:02:10 +02:00

Confirmed on first sight (took me a while to reproduce this though), will have a closer look later (or get help onboard if I cant find a fix)

1  BKE_nlastrip_find_active nla.c             1106 0x26427d3 
2  BKE_nla_tweakedit_remap  nla.c             545  0x26418b3 
3  doAnimEdit_SnapFrame     transform.c       8101 0x19f149b 
4  applyTimeTranslateValue  transform.c       8284 0x19f1cde 
5  applyTimeTranslate       transform.c       8309 0x19f1e74 
6  transformApply           transform.c       2374 0x19cdf6c 
7  transform_modal          transform_ops.c   412  0x1a273de 
8  wm_handler_operator_call wm_event_system.c 1743 0x1810934 
9  wm_handlers_do_intern    wm_event_system.c 2156 0x181199e 
10 wm_handlers_do           wm_event_system.c 2195 0x1811a97 
11 wm_event_do_handlers     wm_event_system.c 2481 0x1812737 
12 WM_main                  wm.c              522  0x1805dfe 
13 main                     creator.c         539  0x1800822

Confirmed on first sight (took me a while to reproduce this though), will have a closer look later (or get help onboard if I cant find a fix) ``` 1 BKE_nlastrip_find_active nla.c 1106 0x26427d3 2 BKE_nla_tweakedit_remap nla.c 545 0x26418b3 3 doAnimEdit_SnapFrame transform.c 8101 0x19f149b 4 applyTimeTranslateValue transform.c 8284 0x19f1cde 5 applyTimeTranslate transform.c 8309 0x19f1e74 6 transformApply transform.c 2374 0x19cdf6c 7 transform_modal transform_ops.c 412 0x1a273de 8 wm_handler_operator_call wm_event_system.c 1743 0x1810934 9 wm_handlers_do_intern wm_event_system.c 2156 0x181199e 10 wm_handlers_do wm_event_system.c 2195 0x1811a97 11 wm_event_do_handlers wm_event_system.c 2481 0x1812737 12 WM_main wm.c 522 0x1805dfe 13 main creator.c 539 0x1800822 ```

Philipp Oeser commented

2018-04-30 14:30:04 +02:00

Hm, something weird (at least for my experience) going on with memory corruption?
I was debugging in QTCreator and for the above backtrace [previous post -- where it crashes in BKE_nlastrip_find_active] the NlaTrack pointer was 0x2?

I've got two other backtraces:
In the first one again NlaTrack pointer is again not NULL but cant be resolved to a NlaTrack either

1  BKE_nlatrack_find_active nla.c             926  0x26423c1 
2  BKE_nla_tweakedit_remap  nla.c             542  0x26418cf 
3  doAnimEdit_SnapFrame     transform.c       8101 0x19f14a1 
4  applyTimeTranslateValue  transform.c       8284 0x19f1ce4 
5  applyTimeTranslate       transform.c       8309 0x19f1e7a 
6  transformApply           transform.c       2374 0x19cdf72 
7  transform_modal          transform_ops.c   412  0x1a273e4 
8  wm_handler_operator_call wm_event_system.c 1743 0x1810934 
9  wm_handlers_do_intern    wm_event_system.c 2156 0x181199e 
10 wm_handlers_do           wm_event_system.c 2195 0x1811a97 
11 wm_event_do_handlers     wm_event_system.c 2481 0x1812737 
12 WM_main                  wm.c              522  0x1805dfe 
13 main                     creator.c         539  0x1800822

this one might be unrelated (still posting it here...)

1  BLI_ghashIterator_getKey             BLI_ghash.h          137  0x29846a3 
2  check_unused_keys                    moviecache.c         150  0x29846a3 
3  IMB_moviecache_cleanup               moviecache.c         477  0x29850bb 
4  BKE_sequencer_cache_cleanup_sequence seqcache.c           153  0x26bec91 
5  sequence_do_invalidate_dependent     sequencer.c          4100 0x26e3037 
6  sequence_invalidate_cache            sequencer.c          4135 0x26e3127 
7  BKE_sequence_invalidate_dependent    sequencer.c          4145 0x26e3181 
8  recalcData_sequencer                 transform_generics.c 983  0x1a1b387 
9  recalcData                           transform_generics.c 1034 0x1a1b529 
10 applyTimeTranslate                   transform.c          8311 0x19f1e89 
11 transformApply                       transform.c          2374 0x19cdf72 
12 transform_modal                      transform_ops.c      412  0x1a273e4 
13 wm_handler_operator_call             wm_event_system.c    1743 0x1810934 
14 wm_handlers_do_intern                wm_event_system.c    2156 0x181199e 
15 wm_handlers_do                       wm_event_system.c    2195 0x1811a97 
16 wm_event_do_handlers                 wm_event_system.c    2481 0x1812737 
17 WM_main                              wm.c                 522  0x1805dfe 
18 main                                 creator.c            539  0x1800822

maybe a look with ASAN helps, gonna try later...

Hm, something weird (at least for my experience) going on with memory corruption? I was debugging in QTCreator and for the above backtrace [previous post -- where it crashes in BKE_nlastrip_find_active] the NlaTrack pointer was 0x2? I've got two other backtraces: In the first one again NlaTrack pointer is again not NULL but cant be resolved to a NlaTrack either ``` 1 BKE_nlatrack_find_active nla.c 926 0x26423c1 2 BKE_nla_tweakedit_remap nla.c 542 0x26418cf 3 doAnimEdit_SnapFrame transform.c 8101 0x19f14a1 4 applyTimeTranslateValue transform.c 8284 0x19f1ce4 5 applyTimeTranslate transform.c 8309 0x19f1e7a 6 transformApply transform.c 2374 0x19cdf72 7 transform_modal transform_ops.c 412 0x1a273e4 8 wm_handler_operator_call wm_event_system.c 1743 0x1810934 9 wm_handlers_do_intern wm_event_system.c 2156 0x181199e 10 wm_handlers_do wm_event_system.c 2195 0x1811a97 11 wm_event_do_handlers wm_event_system.c 2481 0x1812737 12 WM_main wm.c 522 0x1805dfe 13 main creator.c 539 0x1800822 ``` this one might be unrelated (still posting it here...) ``` 1 BLI_ghashIterator_getKey BLI_ghash.h 137 0x29846a3 2 check_unused_keys moviecache.c 150 0x29846a3 3 IMB_moviecache_cleanup moviecache.c 477 0x29850bb 4 BKE_sequencer_cache_cleanup_sequence seqcache.c 153 0x26bec91 5 sequence_do_invalidate_dependent sequencer.c 4100 0x26e3037 6 sequence_invalidate_cache sequencer.c 4135 0x26e3127 7 BKE_sequence_invalidate_dependent sequencer.c 4145 0x26e3181 8 recalcData_sequencer transform_generics.c 983 0x1a1b387 9 recalcData transform_generics.c 1034 0x1a1b529 10 applyTimeTranslate transform.c 8311 0x19f1e89 11 transformApply transform.c 2374 0x19cdf72 12 transform_modal transform_ops.c 412 0x1a273e4 13 wm_handler_operator_call wm_event_system.c 1743 0x1810934 14 wm_handlers_do_intern wm_event_system.c 2156 0x181199e 15 wm_handlers_do wm_event_system.c 2195 0x1811a97 16 wm_event_do_handlers wm_event_system.c 2481 0x1812737 17 WM_main wm.c 522 0x1805dfe 18 main creator.c 539 0x1800822 ``` maybe a look with ASAN helps, gonna try later...

Philipp Oeser removed their assignment 2018-04-30 15:08:42 +02:00

Joshua Leung was assigned by Philipp Oeser

2018-04-30 15:08:42 +02:00

Philipp Oeser commented

2018-04-30 15:08:42 +02:00

Added subscriber: @JoshuaLeung

Philipp Oeser commented

2018-04-30 15:08:42 +02:00

ASAN gives me

Read blend: /time-extend-crash/entend-strip-crash.blend
=================================================================
==31734==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030000f1270 at pc 0x000003bf85c8 bp 0x7ffc118a8770 sp 0x7ffc118a8760
READ of size 4 at 0x6030000f1270 thread T0
    - 0 0x3bf85c7 in BKE_nla_tweakedit_remap /blender/source/blender/blenkernel/intern/nla.c:532
    - 1 0x1bd4bcb in doAnimEdit_SnapFrame /blender/source/blender/editors/transform/transform.c:8101
    - 2 0x1bd629d in applyTimeTranslateValue /blender/source/blender/editors/transform/transform.c:8284
    - 3 0x1bd67c6 in applyTimeTranslate /blender/source/blender/editors/transform/transform.c:8309
    - 4 0x1b7939b in transformApply /blender/source/blender/editors/transform/transform.c:2374
    - 5 0x1c6a85b in transform_modal /blender/source/blender/editors/transform/transform_ops.c:412
    - 6 0x16fc73c in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:1743
    - 7 0x16ff0e1 in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:2156
    - 8 0x16ff236 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:2195
    - 9 0x17010cb in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:2481
    - 10 0x16e04cf in WM_main /blender/source/blender/windowmanager/intern/wm.c:522
    - 11 0x16d579b in main /blender/source/creator/creator.c:539
    - 12 0x7f4aafda8f29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    - 13 0x16d4a59 in _start (/build_279/bin/blender+0x16d4a59)

0x6030000f1270 is located 0 bytes inside of 32-byte region [0x6030000f1270,0x6030000f1290)
freed by thread T0 here:
    - 0 0x7f4abaf314b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
    - 1 0x7f4ab0fcd183  (/lib64/libX11.so.6+0x43183)

previously allocated by thread T0 here:
    - 0 0x7f4abaf31850 in malloc (/lib64/libasan.so.4+0xde850)
    - 1 0x7f4aa6b0f6cb  (/lib64/libxcb.so.1+0xe6cb)

checking for NULL doesnt seems to help in these places, I'm afraid I have to pass this on to @JoshuaLeung ...

ASAN gives me ``` Read blend: /time-extend-crash/entend-strip-crash.blend ================================================================= ==31734==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030000f1270 at pc 0x000003bf85c8 bp 0x7ffc118a8770 sp 0x7ffc118a8760 READ of size 4 at 0x6030000f1270 thread T0 - 0 0x3bf85c7 in BKE_nla_tweakedit_remap /blender/source/blender/blenkernel/intern/nla.c:532 - 1 0x1bd4bcb in doAnimEdit_SnapFrame /blender/source/blender/editors/transform/transform.c:8101 - 2 0x1bd629d in applyTimeTranslateValue /blender/source/blender/editors/transform/transform.c:8284 - 3 0x1bd67c6 in applyTimeTranslate /blender/source/blender/editors/transform/transform.c:8309 - 4 0x1b7939b in transformApply /blender/source/blender/editors/transform/transform.c:2374 - 5 0x1c6a85b in transform_modal /blender/source/blender/editors/transform/transform_ops.c:412 - 6 0x16fc73c in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:1743 - 7 0x16ff0e1 in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:2156 - 8 0x16ff236 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:2195 - 9 0x17010cb in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:2481 - 10 0x16e04cf in WM_main /blender/source/blender/windowmanager/intern/wm.c:522 - 11 0x16d579b in main /blender/source/creator/creator.c:539 - 12 0x7f4aafda8f29 in __libc_start_main (/lib64/libc.so.6+0x20f29) - 13 0x16d4a59 in _start (/build_279/bin/blender+0x16d4a59) 0x6030000f1270 is located 0 bytes inside of 32-byte region [0x6030000f1270,0x6030000f1290) freed by thread T0 here: - 0 0x7f4abaf314b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8) - 1 0x7f4ab0fcd183 (/lib64/libX11.so.6+0x43183) previously allocated by thread T0 here: - 0 0x7f4abaf31850 in malloc (/lib64/libasan.so.4+0xde850) - 1 0x7f4aa6b0f6cb (/lib64/libxcb.so.1+0xe6cb) ``` checking for NULL doesnt seems to help in these places, I'm afraid I have to pass this on to @JoshuaLeung ...

Richard Antalik commented

2019-02-19 22:17:37 +01:00

Added subscriber: @iss

Richard Antalik commented

2019-02-19 22:17:37 +01:00

Changed status from 'Open' to: 'Archived'

Richard Antalik closed this issue

2019-02-19 22:17:37 +01:00

Richard Antalik commented

2019-02-19 22:17:37 +01:00

Can not reproduce in 2.8. Also pressing ctrl had no effect.

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor is over the strip #54891