Crash when changing Particle type, when Hair has dynamics #58046

New Issue

Mal Duffin · 2018-11-25T11:53:32+01:00

Mal Duffin commented

2018-11-25 11:53:32 +01:00

System Information
Windows 10, GTX1070

Blender Version
Broken: Blender 2.8 Alpha 2, 0c8b0771f2

Short description of error
Blender crashes when Hair Dynamics is on, and the Particles type is changed

Exact steps for others to reproduce the error

Create a new scene
Select the default cube
Open the Particles panel
Select Hair
Select Hair Dynamics
Select Emitter

If Blender hasn't crashed yet, select between hair and emitter a few more times

**System Information** Windows 10, GTX1070 **Blender Version** Broken: Blender 2.8 Alpha 2, 0c8b0771f26 **Short description of error** Blender crashes when Hair Dynamics is on, and the Particles type is changed **Exact steps for others to reproduce the error** 1) Create a new scene 2) Select the default cube 3) Open the Particles panel 4) Select Hair 5) Select Hair Dynamics 6) Select Emitter If Blender hasn't crashed yet, select between hair and emitter a few more times

Mal Duffin commented

2018-11-25 11:53:32 +01:00

Added subscriber: @MalDuffin

Philipp Oeser commented

2018-11-27 12:11:16 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2018-11-27 12:11:16 +01:00

Confirmed.

1  MEM_lockfree_allocN_len  mallocn_lockfree_impl.c 120  0x30ea772 
2  MEM_lockfree_freeN       mallocn_lockfree_impl.c 130  0x30ea7b2 
3  modifier_free_ex         modifier.c              171  0x2addb01 
4  modifier_free            modifier.c              178  0x2addb34 
5  free_hair                particle.c              471  0x2b24e5f 
6  psys_changed_type        particle_system.c       4123 0x2b46afb 
7  rna_Particle_change_type rna_particle.c          637  0x2d7f084 
8  rna_property_update      rna_access.c            2084 0x2c653db 
9  RNA_property_update      rna_access.c            2138 0x2c65594

ASAN gives heap-use-after-free For full output see P838

Checking further (there were some changes to modifier freeing code...)

Confirmed. ``` 1 MEM_lockfree_allocN_len mallocn_lockfree_impl.c 120 0x30ea772 2 MEM_lockfree_freeN mallocn_lockfree_impl.c 130 0x30ea7b2 3 modifier_free_ex modifier.c 171 0x2addb01 4 modifier_free modifier.c 178 0x2addb34 5 free_hair particle.c 471 0x2b24e5f 6 psys_changed_type particle_system.c 4123 0x2b46afb 7 rna_Particle_change_type rna_particle.c 637 0x2d7f084 8 rna_property_update rna_access.c 2084 0x2c653db 9 RNA_property_update rna_access.c 2138 0x2c65594 ``` ASAN gives `heap-use-after-free` For full output see [P838](https://archive.blender.org/developer/P838.txt) Checking further (there were some changes to modifier freeing code...)

Sergey Sharybin was assigned by Philipp Oeser

2018-11-27 13:20:34 +01:00

Philipp Oeser commented

2018-11-27 13:20:34 +01:00

Added subscriber: @Sergey

Philipp Oeser commented

2018-11-27 13:20:34 +01:00

Without spending heaps more time, I cannot tell what the underlying issue is.
Well enabling hair dynamics builds hair cloth modifier data, change from hair --> emitter frees the hair cloth modifier data, change from emitter --> hair uses that again (see ASAN P838)

Might be changes to modifier freeing/copying code (d59c2d12b1, 41830cc432 -- dont think so though), might be the specific way CoW does it?

P839 solves (but I guess that breaks the whole idea of keeping the cache, see also comment here )

@Sergey: could you check on this?

Without spending heaps more time, I cannot tell what the underlying issue is. Well enabling hair dynamics builds hair cloth modifier data, change from hair --> emitter frees the hair cloth modifier data, change from emitter --> hair uses that again (see ASAN [P838](https://archive.blender.org/developer/P838.txt)) Might be changes to modifier freeing/copying code (d59c2d12b1, 41830cc432 -- dont think so though), might be the specific way CoW does it? [P839](https://archive.blender.org/developer/P839.txt) solves (but I guess that breaks the whole idea of keeping the cache, see also comment [here ](https://developer.blender.org/diffusion/B/browse/blender2.8/source/blender/blenkernel/intern/particle.c;4c1a01d1a07138aa9b80ab34cc3bde1df5ec141e$596)) @Sergey: could you check on this?

Sergey Sharybin removed their assignment 2018-12-06 15:50:28 +01:00

Philipp Oeser was assigned by Sergey Sharybin

2018-12-06 15:50:28 +01:00

Sergey Sharybin commented

2018-12-06 15:50:28 +01:00

@lichtwerk, you r patch actually seems correct. modifier_free() will free memory used by clmd, and it is supposed to be set to NULL there. I guess this line was lost in one of the other fixes/refactors.

So please commit your P839 :)

@lichtwerk, you r patch actually seems correct. `modifier_free()` will free memory used by `clmd`, and it is supposed to be set to NULL there. I guess this line was lost in one of the other fixes/refactors. So please commit your [P839](https://archive.blender.org/developer/P839.txt) :)

Philipp Oeser commented

2018-12-06 16:04:43 +01:00

@Sergey: thx for checking, will doublecheck again tomorrow (the idea of keeping the cache, had the impression it was not set to NULL on purpose... -- if I dont find anything suspicious, will commit tomorrow)

@Sergey: thx for checking, will doublecheck again tomorrow (the idea of keeping the cache, had the impression it was `not` set to NULL on purpose... -- if I dont find anything suspicious, will commit tomorrow)

Sergey Sharybin commented

2018-12-06 16:16:03 +01:00

That case is handled below. You can also compare the code with master, the clmd = NULL is clearly missing.

That case is handled below. You can also compare the code with master, the `clmd = NULL` is clearly missing.

blender-admin commented

2018-12-07 09:49:28 +01:00

This issue was referenced by 41e4059f3c

This issue was referenced by 41e4059f3c41234016dfabf6b3ae9e40c735483e

Philipp Oeser commented

2018-12-07 10:56:00 +01:00

Changed status from 'Open' to: 'Resolved'

Philipp Oeser closed this issue

2018-12-07 10:56:00 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when changing Particle type, when Hair has dynamics #58046