Page MenuHome

Grease pencil extrude generates broken vertex weights
Closed, ResolvedPublic

Description

System Information
Operating system: Ubuntu 18.04
Graphics card: Radeon RX 580 Series

Blender Version
Blender 2.80 (sub 51), Commit date: 2019-03-22 21:47, Hash faecac0b5e14
Blender 2.80 (sub 51), Commit date: 2019-03-21 23:13, Hash 1ae6aaad43ad

Both recent versions have this bug

Short description of error
Blender sometimes crashes while pressing ctrl+z after any action. Hard to tell exact steps to reproduce bug. In my most recent cases it crashed 1) after I pressed ctrl+z after drawing a grease pencil stroke, 2) after I selected some objects and bones and pressed ctrl+z.
Here are --debug-gpu logs for two recent releases of blender 2.8 and console output



Details

Type
Bug

Event Timeline

Does ./blender --debug-gpu always crash for you? What kernel version are you currently using? (uname -a)

Yes, it always crashes in debug-gpu mode. I mean, it may work okay for some time, but after I do some action (not some particular action, as I can see) and press ctrl+z it may crash blender.

My kernel version is: Linux 4.15.0-46-generic #49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

I was drawing my character and managed to make extremely crashy blender file.

How to reproduce crash:

  1. Do some different actions, at least 2-3 actions (Draw few strokes/ select existing objects/etc. The more you do the higher a chance for it to crash instantly after pressing ctrl+z)
  2. Press ctrl+z few times very fast
  3. It crashes

Sebastian Parborg (zeddb) triaged this task as Needs Information from User priority.

I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now.

What is the output of glxinfo | grep OpenGL ?

Sebastian Parborg (zeddb) raised the priority of this task from Needs Information from User to Confirmed, Medium.

Actually, nevermind I can reproduce this crash on my end too.

If I open that file and select the character and go into GP draw mode, draw 10 strokes or so and then undo a bunch I get the following segfault:

Thread 1 "blender" received signal SIGSEGV, Segmentation fault.
0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203
203	/var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h: Filen eller katalogen finns inte.
(gdb) bt
#0  0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203
#1  arena_dalloc (slow_path=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/arena_inlines_b.h:232
#2  idalloctm (slow_path=false, is_internal=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/jemalloc_internal_inlines_c.h:118
#3  ifree (slow_path=false, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2222
#4  free (ptr=0x7fffe67dd000) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2393
#5  0x0000555558978f82 in MEM_lockfree_freeN (vmemh=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156
#6  0x000055555863ccad in mempool_chunk_free (mpchunk=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:255
#7  0x000055555863ccd5 in mempool_chunk_free_all (mpchunk=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:264
#8  0x000055555863dd61 in BLI_mempool_destroy (pool=0x7fffcca78408)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:765
#9  0x0000555558631404 in BLI_ghash_free (gh=0x7fffcc4bd7b8, keyfreefp=0x0, valfreefp=0x55555870714a <DEG::free_rootpchanmap_valueset(void*)>)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_ghash.c:1015
#10 0x00005555587071bf in DEG::RootPChanMap::~RootPChanMap (this=0x7fffffffd358, __in_chrg=<optimized out>)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_pchanmap.cc:50
#11 0x00005555586f8bee in DEG::DepsgraphRelationBuilder::build_rig (this=0x7fffffffd8f0, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_rig.cc:355
#12 0x00005555586ee44d in DEG::DepsgraphRelationBuilder::build_object_data (this=0x7fffffffd8f0, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:770
#13 0x00005555586edfc4 in DEG::DepsgraphRelationBuilder::build_object (this=0x7fffffffd8f0, base=0x7fffc9ae73e8, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:676
#14 0x00005555586f9133 in DEG::DepsgraphRelationBuilder::build_view_layer (this=0x7fffffffd8f0, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_view_layer.cc:88
#15 0x00005555586cb379 in DEG_graph_build_from_view_layer (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:266
#16 0x00005555586cb5bc in DEG_graph_relations_update (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:326
#17 0x00005555582e50a7 in BKE_scene_graph_update_tagged (depsgraph=0x7fffca44e408, bmain=0x7fffc998cb08)
    at /home/zed/programmering/blender_master/blender/source/blender/blenkernel/intern/scene.c:1503
#18 0x000055555722fa4b in wm_event_do_depsgraph (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:342
#19 0x000055555722fb44 in wm_event_do_refresh_wm_and_depsgraph (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:367
#20 0x0000555557230384 in wm_event_do_notifiers (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:525
#21 0x000055555722bb00 in WM_main (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm.c:421
#22 0x00005555572261a4 in main (argc=1, argv=0x7fffffffdd28) at /home/zed/programmering/blender_master/blender/source/creator/creator.c:505

@Sergey Sharybin (sergey) is this for you? It seem to be DEG stuff.

I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now.
What is the output of glxinfo | grep OpenGL ?

Currently I'm using proprietary AMD Radeon drivers "amdgpu-pro-18.40-676022-ubuntu-18.04"
I'm also on AMD Ryzen 2600x processor.

It takes me drawing one grease pencil stroke to instantly crash this file after pressing ctrl+z

My error does not appear to be related to DEG. I had to draw two strokes and hit undo twice to trigger the crash. (Fedora with 4.20.16 kernel). I was not able to trigger the crash on windows 10 .

Thread 1 "blender" received signal SIGSEGV, Segmentation fault.
0x00007ffff7d5166b in je_large_dalloc () from /lib64/libjemalloc.so.2

#0  0x00007ffff7d5166b in je_large_dalloc () at /lib64/libjemalloc.so.2
#1  0x0000000002e67418 in MEM_lockfree_freeN (vmemh=0x7fffa58ef0d8)
    at /home/user/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156
#2  0x00000000025e4152 in direct_link_dverts (fd=0x7fffa93ea208, count=53, mdverts=0x7fffa875ae68)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:4970
#3  0x00000000025eb69a in direct_link_gpencil (fd=0x7fffa93ea208, gpd=0x7fffa285f248)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:7029
#4  0x00000000025f1962 in read_libblock
    (fd=0x7fffa93ea208, main=0x7fffa5922b08, bhead=0x7fffb7f529a8, tag=0, r_id=0x0)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9132
#5  0x00000000025f2d24 in blo_read_file_internal
    (fd=0x7fffa93ea208, filepath=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend")
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9558
#6  0x00000000025d77d4 in BLO_read_from_memfile
    (oldmain=0x7fffa87f7a08, filename=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend", memfile=0x7fffa5831808, skip_flags=BLO_READ_SKIP_NONE, reports=0x0)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readblenentry.c:392
#7  0x0000000002708a70 in BKE_blendfile_read_from_memfile
    (C=0x7fffe16ccc88, memfile=0x7fffa5831808, params=0x7fffffffd7dc, reports=0x0)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/blendfile.c:439
#8  0x000000000270797f in BKE_memfile_undo_decode (mfu=0x7fffa5831408, C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/blender_undo.c:79
#9  0x00000000019c9269 in memfile_undosys_step_decode (C=0x7fffe16ccc88, 
    bmain=0x7fffa87f7a08, us_p=0x7fffa85d3588, UNUSED_dir=-1)
    at /home/user/blender-git/blender/source/blender/editors/undo/memfile_undo.c:90
#10 0x0000000002963b68 in undosys_step_decode
    (C=0x7fffe16ccc88, bmain=0x7fffa87f7a08, ustack=0x7fffa8964188, us=0x7fffa85d3588, dir=-1)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:197
#11 0x0000000002965514 in BKE_undosys_step_undo_with_data_ex
    (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3588, use_skip=true)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:669
#12 0x0000000002965648 in BKE_undosys_step_undo_with_data
    (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3208)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:685
#13 0x0000000002965675 in BKE_undosys_step_undo (ustack=0x7fffa8964188, C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:690
#14 0x00000000019c7d1f in ed_undo_step (C=0x7fffe16ccc88, step=1, undoname=0x0, reports=0x7fffa677f078)
    at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:173
#15 0x00000000019c8219 in ed_undo_exec (C=0x7fffe16ccc88, op=0x7fffa5dddc48)
    at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:317
#16 0x0000000001988e32 in wm_operator_invoke
    (C=0x7fffe16ccc88, ot=0x7fffd9cf5068, event=0x7fffa85d3088, properties=0x7fffb8461c68, reports=0x0, poll_only=false, use_last_properties=true)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1353
#17 0x000000000198abd8 in wm_handler_operator_call
    (C=0x7fffe16ccc88, handlers=0x7fffa90a7b88, handler_base=0x7fffd9f525a8, event=0x7fffa85d3088, properties=0x7fffb8461c68)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2144
#18 0x000000000198b70a in wm_handlers_do_intern
    (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2462
#19 0x000000000198c374 in wm_handlers_do
    (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2720
#20 0x000000000198d90a in wm_event_do_handlers (C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172
#21 0x00000000019821c1 in WM_main (C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm.c:418
#22 0x000000000197cca1 in main (argc=1, argv=0x7fffffffe028)
    at /home/user/blender-git/blender/source/creator/creator.c:505
Brecht Van Lommel (brecht) raised the priority of this task from Confirmed, Medium to Confirmed, High.Apr 1 2019, 1:52 PM

This goes deeper into grease pencil code, which does not handle vertex groups weights correctly in some cases.
For example, extrude operator leaves two stroke points which points to the same weights array.

@Antonio Vazquez (antoniov), there is missing duplication of dw in gpencil_add_move_points(). Simply open the file from below, extrude, save and reload and see heap-use-after-free in direct_link_dverts().

P.S. Not sure we can easily fix existing files, so attaching a corrected one which should have all pointers assigned correctly.

@Sergey Sharybin (sergey) Thanks for the info, I think I can fix it.

matc (matc) added a comment.EditedApr 2 2019, 9:25 PM

With this change it's possible to work with the original file. There are 10 blocks ("Data from GD") remaining, that are not freed until the file has been saved once.

diff --git a/source/blender/blenloader/intern/readfile.c b/source/blender/blenloader/intern/readfile.c
index eedd116d31f..ffa76dfd3b7 100644
--- a/source/blender/blenloader/intern/readfile.c
+++ b/source/blender/blenloader/intern/readfile.c
@@ -4956,12 +4956,8 @@ static void direct_link_dverts(FileData *fd, int count, MDeformVert *mdverts)
 	for (i = count; i > 0; i--, mdverts++) {
 		/*convert to vgroup allocation system*/
 		MDeformWeight *dw;
-		if (mdverts->dw && (dw = newdataadr(fd, mdverts->dw))) {
-			const ssize_t dw_len = mdverts->totweight * sizeof(MDeformWeight);
-			void *dw_tmp = MEM_mallocN(dw_len, "direct_link_dverts");
-			memcpy(dw_tmp, dw, dw_len);
-			mdverts->dw = dw_tmp;
-			MEM_freeN(dw);
+		if (mdverts->dw && (dw = newdataadr_no_us(fd, mdverts->dw))) {
+			mdverts->dw = MEM_dupallocN(dw);
 		}
 		else {
 			mdverts->dw = NULL;

Edit: I did a quick test on windows 10. The patch removes the Couldn't unmap memory errors when opening the file. The 10 blocks remain unfreed, until once saved and blender reopened.

Brecht Van Lommel (brecht) closed this task as Resolved.

With the extrude bug fixed I think we can close this issue.

Brecht Van Lommel (brecht) renamed this task from Blender 2.8 "ctrl+z" crashes, segmentation fault to Grease pencil extrude generates broken vertex weights.Apr 4 2019, 11:55 PM