Page MenuHome

Crash when changing Particle type, when Hair has dynamics
Closed, ResolvedPublic

Description

System Information
Windows 10, GTX1070

Blender Version
Broken: Blender 2.8 Alpha 2, 0c8b0771f26

Short description of error
Blender crashes when Hair Dynamics is on, and the Particles type is changed

Exact steps for others to reproduce the error

  1. Create a new scene
  2. Select the default cube
  3. Open the Particles panel
  4. Select Hair
  5. Select Hair Dynamics
  6. Select Emitter

If Blender hasn't crashed yet, select between hair and emitter a few more times

Event Timeline

Philipp Oeser (lichtwerk) lowered the priority of this task from Needs Triage by Developer to Confirmed, Medium.Nov 27 2018, 12:11 PM

Confirmed.

1  MEM_lockfree_allocN_len  mallocn_lockfree_impl.c 120  0x30ea772 
2  MEM_lockfree_freeN       mallocn_lockfree_impl.c 130  0x30ea7b2 
3  modifier_free_ex         modifier.c              171  0x2addb01 
4  modifier_free            modifier.c              178  0x2addb34 
5  free_hair                particle.c              471  0x2b24e5f 
6  psys_changed_type        particle_system.c       4123 0x2b46afb 
7  rna_Particle_change_type rna_particle.c          637  0x2d7f084 
8  rna_property_update      rna_access.c            2084 0x2c653db 
9  RNA_property_update      rna_access.c            2138 0x2c65594

ASAN gives heap-use-after-free For full output see P838

Checking further (there were some changes to modifier freeing code...)

Without spending heaps more time, I cannot tell what the underlying issue is.
Well enabling hair dynamics builds hair cloth modifier data, change from hair --> emitter frees the hair cloth modifier data, change from emitter --> hair uses that again (see ASAN P838)

Might be changes to modifier freeing/copying code (rBd59c2d12b122, rB41830cc432b9 -- dont think so though), might be the specific way CoW does it?

P839 solves (but I guess that breaks the whole idea of keeping the cache, see also comment here)

@Sergey Sharybin (sergey): could you check on this?

@Philipp Oeser (lichtwerk), you r patch actually seems correct. modifier_free() will free memory used by clmd, and it is supposed to be set to NULL there. I guess this line was lost in one of the other fixes/refactors.

So please commit your P839 :)

@Sergey Sharybin (sergey): thx for checking, will doublecheck again tomorrow (the idea of keeping the cache, had the impression it was not set to NULL on purpose... -- if I dont find anything suspicious, will commit tomorrow)

That case is handled below. You can also compare the code with master, the clmd = NULL is clearly missing.