Page MenuHome

Crash in ASAN debug builds due to use-after-free memory in draw code - instances issue?
Closed, ResolvedPublic

Description

Found while checking T55204. Just open /scenes/01-opening/01_050_A/01_050_A.anim.28.blend in an ASAN-enabled debug build of Blender2.8, immediately crash on first drawing with following info:

=================================================================
==4716==ERROR: AddressSanitizer: heap-use-after-free on address 0x61901a7b6fac at pc 0x7fedf46826c2 bp 0x7ffe9d2f8b00 sp 0x7ffe9d2f82b0
READ of size 12 at 0x61901a7b6fac thread T0
    #0 0x7fedf46826c1  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1)
    #1 0x7fedc6b44627  (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f3627)
    #2 0x7fedc6b45b16  (/usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so+0x1f4b16)
    #3 0x564258500bb4 in GPU_shader_uniform_vector /home/guest/blender/blender/source/blender/gpu/intern/gpu_shader.c:623
    #4 0x56425857ce2a in draw_shgroup /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:988
    #5 0x56425857eb07 in drw_draw_pass_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1202
    #6 0x56425857eecb in DRW_draw_pass /home/guest/blender/blender/source/blender/draw/intern/draw_manager_exec.c:1235
    #7 0x5642586635bf in workbench_deferred_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:569
    #8 0x56425860d67e in workbench_solid_draw_scene /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:71
    #9 0x564258564c91 in drw_engines_draw_scene /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:891
    #10 0x564258566c9e in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1334
    #11 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    #12 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    #13 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    #14 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    #15 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    #16 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    #17 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    #18 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    #19 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    #20 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)
    #21 0x56425676d349 in _start (/home/guest/blender/build_2.8_debug/bin/blender+0x3318349)

0x61901a7b6fac is located 44 bytes inside of 904-byte region [0x61901a7b6f80,0x61901a7b7308)
freed by thread T0 here:
    #0 0x7fedf46e58c8 in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd98c8)
    #1 0x564259cb9f83 in MEM_lockfree_freeN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164
    #2 0x564259cba226 in MEM_lockfree_reallocN_id /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:223
    #3 0x56425855f3f1 in DRW_instance_data_next /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:329
    #4 0x5642585643f5 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:768
    #5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349
    #6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481
    #7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53
    #8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841
    #9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289
    #10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    #11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    #12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    #13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    #14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    #15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    #16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    #17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    #18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    #19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)

previously allocated by thread T0 here:
    #0 0x7fedf46e5c20 in __interceptor_malloc (/usr/lib/x86_64-linux-gnu/libasan.so.4+0xd9c20)
    #1 0x564259cba713 in MEM_lockfree_mallocN /home/guest/blender/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:318
    #2 0x56425855efee in drw_instance_data_create /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:295
    #3 0x56425855f68d in DRW_instance_data_request /home/guest/blender/blender/source/blender/draw/intern/draw_instance_data.c:355
    #4 0x564258564356 in DRW_object_engine_data_ensure /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:766
    #5 0x564258661b13 in get_or_create_material_data /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:349
    #6 0x564258662d50 in workbench_deferred_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/workbench_deferred.c:481
    #7 0x56425860d615 in workbench_solid_cache_populate /home/guest/blender/blender/source/blender/draw/engines/workbench/solid_mode.c:53
    #8 0x5642585648e1 in drw_engines_cache_populate /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:841
    #9 0x56425856692d in DRW_draw_render_loop_ex /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1289
    #10 0x5642585662af in DRW_draw_view /home/guest/blender/blender/source/blender/draw/intern/draw_manager.c:1231
    #11 0x564256a93cf3 in view3d_draw_view /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1245
    #12 0x564256a93ddb in view3d_main_region_draw /home/guest/blender/blender/source/blender/editors/space_view3d/view3d_draw.c:1265
    #13 0x5642575eeec9 in ED_region_do_draw /home/guest/blender/blender/source/blender/editors/screen/area.c:472
    #14 0x564256787669 in wm_draw_window_offscreen /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:536
    #15 0x5642567881a2 in wm_draw_window /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:662
    #16 0x564256788bed in wm_draw_update /home/guest/blender/blender/source/blender/windowmanager/intern/wm_draw.c:816
    #17 0x564256778cdd in WM_main /home/guest/blender/blender/source/blender/windowmanager/intern/wm.c:551
    #18 0x56425676deeb in main /home/guest/blender/blender/source/creator/creator.c:514
    #19 0x7fedec984a86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21a86)

SUMMARY: AddressSanitizer: heap-use-after-free (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) 
Shadow bytes around the buggy address:
  0x0c32834eeda0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c32834eedd0: 00 00 00 00 00 00 00 00 00 04 fa fa fa fa fa fa
  0x0c32834eede0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c32834eedf0: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c32834eee40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

Event Timeline

Bastien Montagne (mont29) lowered the priority of this task from Needs Triage by Developer to Confirmed, Medium.May 29 2018, 11:43 AM
Bastien Montagne (mont29) raised the priority of this task from Confirmed, Medium to Confirmed, High.
Bastien Montagne (mont29) created this task.
Bastien Montagne (mont29) moved this task from Tasks to Spring Bugs on the Code Quest board.
Bastien Montagne (mont29) updated the task description. (Show Details)

not fixed here :P

Bastien Montagne (mont29) closed this task as Resolved.May 30 2018, 2:41 PM

Sorry, my bad, it is fixed for me too.