Grease pencil extrude generates broken vertex weights #62872

New Issue

Anna Ivanova · 2019-03-23T06:00:36+01:00

Anna Ivanova commented

2019-03-23 06:00:36 +01:00

System Information
Operating system: Ubuntu 18.04
Graphics card: Radeon RX 580 Series

Blender Version
Blender 2.80 (sub 51), Commit date: 2019-03-22 21:47, Hash faecac0b5e
Blender 2.80 (sub 51), Commit date: 2019-03-21 23:13, Hash 1ae6aaad43

Both recent versions have this bug

Short description of error
Blender sometimes crashes while pressing ctrl+z after any action. Hard to tell exact steps to reproduce bug. In my most recent cases it crashed 1) after I pressed ctrl+z after drawing a grease pencil stroke, 2) after I selected some objects and bones and pressed ctrl+z.
Here are --debug-gpu logs for two recent releases of blender 2.8 and console output
test.crash.txt
test2.crash.txt
bl debug log

**System Information** Operating system: Ubuntu 18.04 Graphics card: Radeon RX 580 Series **Blender Version** Blender 2.80 (sub 51), Commit date: 2019-03-22 21:47, Hash faecac0b5e14 Blender 2.80 (sub 51), Commit date: 2019-03-21 23:13, Hash 1ae6aaad43ad Both recent versions have this bug **Short description of error** Blender sometimes crashes while pressing ctrl+z after any action. Hard to tell exact steps to reproduce bug. In my most recent cases it crashed 1) after I pressed ctrl+z after drawing a grease pencil stroke, 2) after I selected some objects and bones and pressed ctrl+z. Here are --debug-gpu logs for two recent releases of blender 2.8 and console output [test.crash.txt](https://archive.blender.org/developer/F6868282/test.crash.txt) [test2.crash.txt](https://archive.blender.org/developer/F6868314/test2.crash.txt) [bl debug log](https://archive.blender.org/developer/F6868288/bl_debug_log)

Anna Ivanova commented

2019-03-23 06:00:36 +01:00

Added subscriber: @AnnaIv

matc commented

2019-03-23 08:30:05 +01:00

Added subscriber: @matc

matc commented

2019-03-23 08:38:27 +01:00

Does ./blender --debug-gpu always crash for you? What kernel version are you currently using? (uname -a)

Does `./blender --debug-gpu` always crash for you? What kernel version are you currently using? (`uname -a`)

Anna Ivanova commented

2019-03-23 12:33:22 +01:00

Yes, it always crashes in debug-gpu mode. I mean, it may work okay for some time, but after I do some action (not some particular action, as I can see) and press ctrl+z it may crash blender.

**My kernel version is:**Linux 4.15.0-46-generic #49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Yes, it always crashes in debug-gpu mode. I mean, it may work okay for some time, but after I do some action (not some particular action, as I can see) and press ctrl+z it may crash blender. **My kernel version is:**Linux 4.15.0-46-generic #49-Ubuntu SMP Wed Feb 6 09:33:07 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Anna Ivanova commented

2019-03-23 13:46:06 +01:00

I was drawing my character and managed to make extremely crashy blender file.

How to reproduce crash:

Do some different actions, at least 2-3 actions (Draw few strokes/ select existing objects/etc. The more you do the higher a chance for it to crash instantly after pressing ctrl+z)
Press ctrl+z few times very fast
It crashes
test crash.blend

I was drawing my character and managed to make extremely crashy blender file. How to reproduce crash: 1. Do some different actions, at least 2-3 actions (Draw few strokes/ select existing objects/etc. The more you do the higher a chance for it to crash instantly after pressing ctrl+z) 2. Press ctrl+z few times very fast 3. It crashes [test crash.blend](https://archive.blender.org/developer/F6869822/test_crash.blend)

Sebastian Parborg commented

2019-03-23 19:14:36 +01:00

Added subscriber: @ZedDB

Sebastian Parborg commented

2019-03-23 19:14:36 +01:00

I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now.

What is the output of glxinfo | grep OpenGL ?

I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now. What is the output of `glxinfo | grep OpenGL` ?

Sergey Sharybin was assigned by Sebastian Parborg

2019-03-23 19:19:48 +01:00

Sebastian Parborg commented

2019-03-23 19:19:48 +01:00

Added subscriber: @Sergey

Sebastian Parborg commented

2019-03-23 19:19:48 +01:00

Actually, nevermind I can reproduce this crash on my end too.

If I open that file and select the character and go into GP draw mode, draw 10 strokes or so and then undo a bunch I get the following segfault:

Thread 1 "blender" received signal SIGSEGV, Segmentation fault.
0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203
203	/var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h: Filen eller katalogen finns inte.
(gdb) bt
#0  0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203
#1  arena_dalloc (slow_path=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/arena_inlines_b.h:232
#2  idalloctm (slow_path=false, is_internal=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/jemalloc_internal_inlines_c.h:118
#3  ifree (slow_path=false, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsd=<optimized out>)
    at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2222
- 4  free (ptr=0x7fffe67dd000) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2393
- 5  0x0000555558978f82 in MEM_lockfree_freeN (vmemh=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156
#6  0x000055555863ccad in mempool_chunk_free (mpchunk=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:255
#7  0x000055555863ccd5 in mempool_chunk_free_all (mpchunk=0x7fffe67dd008)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:264
#8  0x000055555863dd61 in BLI_mempool_destroy (pool=0x7fffcca78408)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:765
#9  0x0000555558631404 in BLI_ghash_free (gh=0x7fffcc4bd7b8, keyfreefp=0x0, valfreefp=0x55555870714a <DEG::free_rootpchanmap_valueset(void*)>)
    at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_ghash.c:1015
#10 0x00005555587071bf in DEG::RootPChanMap::~RootPChanMap (this=0x7fffffffd358, __in_chrg=<optimized out>)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_pchanmap.cc:50
#11 0x00005555586f8bee in DEG::DepsgraphRelationBuilder::build_rig (this=0x7fffffffd8f0, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_rig.cc:355
#12 0x00005555586ee44d in DEG::DepsgraphRelationBuilder::build_object_data (this=0x7fffffffd8f0, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:770
#13 0x00005555586edfc4 in DEG::DepsgraphRelationBuilder::build_object (this=0x7fffffffd8f0, base=0x7fffc9ae73e8, object=0x7fffc9fe3a08)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:676
#14 0x00005555586f9133 in DEG::DepsgraphRelationBuilder::build_view_layer (this=0x7fffffffd8f0, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_view_layer.cc:88
#15 0x00005555586cb379 in DEG_graph_build_from_view_layer (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:266
#16 0x00005555586cb5bc in DEG_graph_relations_update (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48)
    at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:326
#17 0x00005555582e50a7 in BKE_scene_graph_update_tagged (depsgraph=0x7fffca44e408, bmain=0x7fffc998cb08)
    at /home/zed/programmering/blender_master/blender/source/blender/blenkernel/intern/scene.c:1503
#18 0x000055555722fa4b in wm_event_do_depsgraph (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:342
#19 0x000055555722fb44 in wm_event_do_refresh_wm_and_depsgraph (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:367
#20 0x0000555557230384 in wm_event_do_notifiers (C=0x7fffeba29108)
    at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:525
- 21 0x000055555722bb00 in WM_main (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm.c:421
- 22 0x00005555572261a4 in main (argc=1, argv=0x7fffffffdd28) at /home/zed/programmering/blender_master/blender/source/creator/creator.c:505

@Sergey is this for you? It seem to be DEG stuff.

Actually, nevermind I can reproduce this crash on my end too. If I open that file and select the character and go into GP draw mode, draw 10 strokes or so and then undo a bunch I get the following segfault: ``` Thread 1 "blender" received signal SIGSEGV, Segmentation fault. 0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203 203 /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h: Filen eller katalogen finns inte. (gdb) bt #0 0x00007ffff7d47f5b in tcache_dalloc_large (slow_path=false, binind=0, ptr=0x7fffe67dd000, tcache=0x7fffebf20bb0, tsd=<optimized out>) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/tcache_inlines.h:203 #1 arena_dalloc (slow_path=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/arena_inlines_b.h:232 #2 idalloctm (slow_path=false, is_internal=false, alloc_ctx=<synthetic pointer>, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsdn=<optimized out>) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/include/jemalloc/internal/jemalloc_internal_inlines_c.h:118 #3 ifree (slow_path=false, tcache=0x7fffebf20bb0, ptr=0x7fffe67dd000, tsd=<optimized out>) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2222 - 4 free (ptr=0x7fffe67dd000) at /var/tmp/portage/dev-libs/jemalloc-5.1.0/work/jemalloc-5.1.0/src/jemalloc.c:2393 - 5 0x0000555558978f82 in MEM_lockfree_freeN (vmemh=0x7fffe67dd008) at /home/zed/programmering/blender_master/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156 #6 0x000055555863ccad in mempool_chunk_free (mpchunk=0x7fffe67dd008) at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:255 #7 0x000055555863ccd5 in mempool_chunk_free_all (mpchunk=0x7fffe67dd008) at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:264 #8 0x000055555863dd61 in BLI_mempool_destroy (pool=0x7fffcca78408) at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_mempool.c:765 #9 0x0000555558631404 in BLI_ghash_free (gh=0x7fffcc4bd7b8, keyfreefp=0x0, valfreefp=0x55555870714a <DEG::free_rootpchanmap_valueset(void*)>) at /home/zed/programmering/blender_master/blender/source/blender/blenlib/intern/BLI_ghash.c:1015 #10 0x00005555587071bf in DEG::RootPChanMap::~RootPChanMap (this=0x7fffffffd358, __in_chrg=<optimized out>) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_pchanmap.cc:50 #11 0x00005555586f8bee in DEG::DepsgraphRelationBuilder::build_rig (this=0x7fffffffd8f0, object=0x7fffc9fe3a08) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_rig.cc:355 #12 0x00005555586ee44d in DEG::DepsgraphRelationBuilder::build_object_data (this=0x7fffffffd8f0, object=0x7fffc9fe3a08) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:770 #13 0x00005555586edfc4 in DEG::DepsgraphRelationBuilder::build_object (this=0x7fffffffd8f0, base=0x7fffc9ae73e8, object=0x7fffc9fe3a08) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations.cc:676 #14 0x00005555586f9133 in DEG::DepsgraphRelationBuilder::build_view_layer (this=0x7fffffffd8f0, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/builder/deg_builder_relations_view_layer.cc:88 #15 0x00005555586cb379 in DEG_graph_build_from_view_layer (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:266 #16 0x00005555586cb5bc in DEG_graph_relations_update (graph=0x7fffca44e408, bmain=0x7fffc998cb08, scene=0x7fffcc341008, view_layer=0x7fffc9e7ed48) at /home/zed/programmering/blender_master/blender/source/blender/depsgraph/intern/depsgraph_build.cc:326 #17 0x00005555582e50a7 in BKE_scene_graph_update_tagged (depsgraph=0x7fffca44e408, bmain=0x7fffc998cb08) at /home/zed/programmering/blender_master/blender/source/blender/blenkernel/intern/scene.c:1503 #18 0x000055555722fa4b in wm_event_do_depsgraph (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:342 #19 0x000055555722fb44 in wm_event_do_refresh_wm_and_depsgraph (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:367 #20 0x0000555557230384 in wm_event_do_notifiers (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm_event_system.c:525 - 21 0x000055555722bb00 in WM_main (C=0x7fffeba29108) at /home/zed/programmering/blender_master/blender/source/blender/windowmanager/intern/wm.c:421 - 22 0x00005555572261a4 in main (argc=1, argv=0x7fffffffdd28) at /home/zed/programmering/blender_master/blender/source/creator/creator.c:505 ``` @Sergey is this for you? It seem to be DEG stuff.

Anna Ivanova commented

2019-03-23 19:42:05 +01:00

In #62872#646906, @ZedDB wrote:
I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now.

What is the output of glxinfo | grep OpenGL ?

Currently I'm using proprietary AMD Radeon drivers "amdgpu-pro-18.40-676022-ubuntu-18.04"
I'm also on AMD Ryzen 2600x processor.

It takes me drawing one grease pencil stroke to instantly crash this file after pressing ctrl+z

> In #62872#646906, @ZedDB wrote: > I think that you might need newer GPU drivers. The ones that come with 18.04 per default is ancient by now. > > What is the output of `glxinfo | grep OpenGL` ? Currently I'm using proprietary AMD Radeon drivers **"amdgpu-pro-18.40-676022-ubuntu-18.04"** I'm also on AMD Ryzen 2600x processor. It takes me drawing one grease pencil stroke to instantly crash this file after pressing ctrl+z

matc commented

2019-03-25 20:26:58 +01:00

My error does not appear to be related to DEG. I had to draw two strokes and hit undo twice to trigger the crash. (Fedora with 4.20.16 kernel). I was not able to trigger the crash on windows 10 .

Thread 1 "blender" received signal SIGSEGV, Segmentation fault.
0x00007ffff7d5166b in je_large_dalloc () from /lib64/libjemalloc.so.2

- 0  0x00007ffff7d5166b in je_large_dalloc () at /lib64/libjemalloc.so.2
- 1  0x0000000002e67418 in MEM_lockfree_freeN (vmemh=0x7fffa58ef0d8)
    at /home/user/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156
#2  0x00000000025e4152 in direct_link_dverts (fd=0x7fffa93ea208, count=53, mdverts=0x7fffa875ae68)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:4970
#3  0x00000000025eb69a in direct_link_gpencil (fd=0x7fffa93ea208, gpd=0x7fffa285f248)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:7029
#4  0x00000000025f1962 in read_libblock
    (fd=0x7fffa93ea208, main=0x7fffa5922b08, bhead=0x7fffb7f529a8, tag=0, r_id=0x0)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9132
#5  0x00000000025f2d24 in blo_read_file_internal
    (fd=0x7fffa93ea208, filepath=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend")
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9558
#6  0x00000000025d77d4 in BLO_read_from_memfile
    (oldmain=0x7fffa87f7a08, filename=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend", memfile=0x7fffa5831808, skip_flags=BLO_READ_SKIP_NONE, reports=0x0)
    at /home/user/blender-git/blender/source/blender/blenloader/intern/readblenentry.c:392
#7  0x0000000002708a70 in BKE_blendfile_read_from_memfile
    (C=0x7fffe16ccc88, memfile=0x7fffa5831808, params=0x7fffffffd7dc, reports=0x0)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/blendfile.c:439
#8  0x000000000270797f in BKE_memfile_undo_decode (mfu=0x7fffa5831408, C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/blender_undo.c:79
#9  0x00000000019c9269 in memfile_undosys_step_decode (C=0x7fffe16ccc88, 
    bmain=0x7fffa87f7a08, us_p=0x7fffa85d3588, UNUSED_dir=-1)
    at /home/user/blender-git/blender/source/blender/editors/undo/memfile_undo.c:90
#10 0x0000000002963b68 in undosys_step_decode
    (C=0x7fffe16ccc88, bmain=0x7fffa87f7a08, ustack=0x7fffa8964188, us=0x7fffa85d3588, dir=-1)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:197
#11 0x0000000002965514 in BKE_undosys_step_undo_with_data_ex
    (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3588, use_skip=true)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:669
#12 0x0000000002965648 in BKE_undosys_step_undo_with_data
    (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3208)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:685
#13 0x0000000002965675 in BKE_undosys_step_undo (ustack=0x7fffa8964188, C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:690
#14 0x00000000019c7d1f in ed_undo_step (C=0x7fffe16ccc88, step=1, undoname=0x0, reports=0x7fffa677f078)
    at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:173
#15 0x00000000019c8219 in ed_undo_exec (C=0x7fffe16ccc88, op=0x7fffa5dddc48)
    at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:317
#16 0x0000000001988e32 in wm_operator_invoke
    (C=0x7fffe16ccc88, ot=0x7fffd9cf5068, event=0x7fffa85d3088, properties=0x7fffb8461c68, reports=0x0, poll_only=false, use_last_properties=true)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1353
#17 0x000000000198abd8 in wm_handler_operator_call
    (C=0x7fffe16ccc88, handlers=0x7fffa90a7b88, handler_base=0x7fffd9f525a8, event=0x7fffa85d3088, properties=0x7fffb8461c68)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2144
#18 0x000000000198b70a in wm_handlers_do_intern
    (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2462
#19 0x000000000198c374 in wm_handlers_do
    (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2720
#20 0x000000000198d90a in wm_event_do_handlers (C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172
#21 0x00000000019821c1 in WM_main (C=0x7fffe16ccc88)
    at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm.c:418
#22 0x000000000197cca1 in main (argc=1, argv=0x7fffffffe028)
    at /home/user/blender-git/blender/source/creator/creator.c:505

My error does not appear to be related to DEG. I had to draw two strokes and hit undo twice to trigger the crash. (Fedora with 4.20.16 kernel). I was not able to trigger the crash on windows 10 . ``` Thread 1 "blender" received signal SIGSEGV, Segmentation fault. 0x00007ffff7d5166b in je_large_dalloc () from /lib64/libjemalloc.so.2 - 0 0x00007ffff7d5166b in je_large_dalloc () at /lib64/libjemalloc.so.2 - 1 0x0000000002e67418 in MEM_lockfree_freeN (vmemh=0x7fffa58ef0d8) at /home/user/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:156 #2 0x00000000025e4152 in direct_link_dverts (fd=0x7fffa93ea208, count=53, mdverts=0x7fffa875ae68) at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:4970 #3 0x00000000025eb69a in direct_link_gpencil (fd=0x7fffa93ea208, gpd=0x7fffa285f248) at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:7029 #4 0x00000000025f1962 in read_libblock (fd=0x7fffa93ea208, main=0x7fffa5922b08, bhead=0x7fffb7f529a8, tag=0, r_id=0x0) at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9132 #5 0x00000000025f2d24 in blo_read_file_internal (fd=0x7fffa93ea208, filepath=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend") at /home/user/blender-git/blender/source/blender/blenloader/intern/readfile.c:9558 #6 0x00000000025d77d4 in BLO_read_from_memfile (oldmain=0x7fffa87f7a08, filename=0x7fffa87f7a18 "/home/user/Downloads/test crash.blend", memfile=0x7fffa5831808, skip_flags=BLO_READ_SKIP_NONE, reports=0x0) at /home/user/blender-git/blender/source/blender/blenloader/intern/readblenentry.c:392 #7 0x0000000002708a70 in BKE_blendfile_read_from_memfile (C=0x7fffe16ccc88, memfile=0x7fffa5831808, params=0x7fffffffd7dc, reports=0x0) at /home/user/blender-git/blender/source/blender/blenkernel/intern/blendfile.c:439 #8 0x000000000270797f in BKE_memfile_undo_decode (mfu=0x7fffa5831408, C=0x7fffe16ccc88) at /home/user/blender-git/blender/source/blender/blenkernel/intern/blender_undo.c:79 #9 0x00000000019c9269 in memfile_undosys_step_decode (C=0x7fffe16ccc88, bmain=0x7fffa87f7a08, us_p=0x7fffa85d3588, UNUSED_dir=-1) at /home/user/blender-git/blender/source/blender/editors/undo/memfile_undo.c:90 #10 0x0000000002963b68 in undosys_step_decode (C=0x7fffe16ccc88, bmain=0x7fffa87f7a08, ustack=0x7fffa8964188, us=0x7fffa85d3588, dir=-1) at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:197 #11 0x0000000002965514 in BKE_undosys_step_undo_with_data_ex (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3588, use_skip=true) at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:669 #12 0x0000000002965648 in BKE_undosys_step_undo_with_data (ustack=0x7fffa8964188, C=0x7fffe16ccc88, us=0x7fffa85d3208) at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:685 #13 0x0000000002965675 in BKE_undosys_step_undo (ustack=0x7fffa8964188, C=0x7fffe16ccc88) at /home/user/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:690 #14 0x00000000019c7d1f in ed_undo_step (C=0x7fffe16ccc88, step=1, undoname=0x0, reports=0x7fffa677f078) at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:173 #15 0x00000000019c8219 in ed_undo_exec (C=0x7fffe16ccc88, op=0x7fffa5dddc48) at /home/user/blender-git/blender/source/blender/editors/undo/ed_undo.c:317 #16 0x0000000001988e32 in wm_operator_invoke (C=0x7fffe16ccc88, ot=0x7fffd9cf5068, event=0x7fffa85d3088, properties=0x7fffb8461c68, reports=0x0, poll_only=false, use_last_properties=true) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1353 #17 0x000000000198abd8 in wm_handler_operator_call (C=0x7fffe16ccc88, handlers=0x7fffa90a7b88, handler_base=0x7fffd9f525a8, event=0x7fffa85d3088, properties=0x7fffb8461c68) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2144 #18 0x000000000198b70a in wm_handlers_do_intern (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2462 #19 0x000000000198c374 in wm_handlers_do (C=0x7fffe16ccc88, event=0x7fffa85d3088, handlers=0x7fffa90a7b88) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2720 #20 0x000000000198d90a in wm_event_do_handlers (C=0x7fffe16ccc88) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3172 #21 0x00000000019821c1 in WM_main (C=0x7fffe16ccc88) at /home/user/blender-git/blender/source/blender/windowmanager/intern/wm.c:418 #22 0x000000000197cca1 in main (argc=1, argv=0x7fffffffe028) at /home/user/blender-git/blender/source/creator/creator.c:505 ```

Simon G. commented

2019-03-25 20:57:25 +01:00

Added subscriber: @intrigus-3

Sergey Sharybin removed their assignment 2019-04-01 15:47:04 +02:00

Antonio Vazquez was assigned by Sergey Sharybin

2019-04-01 15:47:04 +02:00

Sergey Sharybin commented

2019-04-01 15:47:04 +02:00

Added subscriber: @antoniov

Sergey Sharybin commented

2019-04-01 15:47:04 +02:00

This goes deeper into grease pencil code, which does not handle vertex groups weights correctly in some cases.
For example, extrude operator leaves two stroke points which points to the same weights array.

@antoniov, there is missing duplication of dw in gpencil_add_move_points(). Simply open the file from below, extrude, save and reload and see heap-use-after-free in direct_link_dverts().

gpencil_stroke_extrude.blend

P.S. Not sure we can easily fix existing files, so attaching a corrected one which should have all pointers assigned correctly.test crash fixed.blend

This goes deeper into grease pencil code, which does not handle vertex groups weights correctly in some cases. For example, extrude operator leaves two stroke points which points to the same weights array. @antoniov, there is missing duplication of `dw` in `gpencil_add_move_points()`. Simply open the file from below, extrude, save and reload and see heap-use-after-free in `direct_link_dverts()`. [gpencil_stroke_extrude.blend](https://archive.blender.org/developer/F6905451/gpencil_stroke_extrude.blend) P.S. Not sure we can easily fix existing files, so attaching a corrected one which should have all pointers assigned correctly.[test crash fixed.blend](https://archive.blender.org/developer/F6905453/test_crash_fixed.blend)

Antonio Vazquez commented

2019-04-01 16:29:56 +02:00

@Sergey Thanks for the info, I think I can fix it.

matc commented

2019-04-02 21:25:42 +02:00

With this change it's possible to work with the original file. There are 10 blocks ("Data from GD") remaining, that are not freed until the file has been saved once.

diff --git a/source/blender/blenloader/intern/readfile.c b/source/blender/blenloader/intern/readfile.c
index eedd116d31f..ffa76dfd3b7 100644
--- a/source/blender/blenloader/intern/readfile.c
+++ b/source/blender/blenloader/intern/readfile.c
@@ -4956,12 +4956,8 @@ static void direct_link_dverts(FileData *fd, int count, MDeformVert *mdverts)
 	for (i = count; i > 0; i--, mdverts++) {
 		/*convert to vgroup allocation system*/
 		MDeformWeight *dw;
-		if (mdverts->dw && (dw = newdataadr(fd, mdverts->dw))) {
-			const ssize_t dw_len = mdverts->totweight * sizeof(MDeformWeight);
-			void *dw_tmp = MEM_mallocN(dw_len, "direct_link_dverts");
-			memcpy(dw_tmp, dw, dw_len);
-			mdverts->dw = dw_tmp;
-			MEM_freeN(dw);
+		if (mdverts->dw && (dw = newdataadr_no_us(fd, mdverts->dw))) {
+			mdverts->dw = MEM_dupallocN(dw);
 		}
 		else {
 			mdverts->dw = NULL;

In #62872#646818, @AnnaIv wrote:
test crash.blend

Edit: I did a quick test on windows 10. The patch removes the Couldn't unmap memory errors when opening the file. The 10 blocks remain unfreed, until once saved and blender reopened.

With this change it's possible to work with the original file. There are 10 blocks ("Data from GD") remaining, that are not freed until the file has been saved once. ``` diff --git a/source/blender/blenloader/intern/readfile.c b/source/blender/blenloader/intern/readfile.c index eedd116d31f..ffa76dfd3b7 100644 --- a/source/blender/blenloader/intern/readfile.c +++ b/source/blender/blenloader/intern/readfile.c @@ -4956,12 +4956,8 @@ static void direct_link_dverts(FileData *fd, int count, MDeformVert *mdverts) for (i = count; i > 0; i--, mdverts++) { /*convert to vgroup allocation system*/ MDeformWeight *dw; - if (mdverts->dw && (dw = newdataadr(fd, mdverts->dw))) { - const ssize_t dw_len = mdverts->totweight * sizeof(MDeformWeight); - void *dw_tmp = MEM_mallocN(dw_len, "direct_link_dverts"); - memcpy(dw_tmp, dw, dw_len); - mdverts->dw = dw_tmp; - MEM_freeN(dw); + if (mdverts->dw && (dw = newdataadr_no_us(fd, mdverts->dw))) { + mdverts->dw = MEM_dupallocN(dw); } else { mdverts->dw = NULL; ``` > In #62872#646818, @AnnaIv wrote: > [test crash.blend](https://archive.blender.org/developer/F6869822/test_crash.blend) Edit: I did a quick test on windows 10. The patch removes the `Couldn't unmap memory` errors when opening the file. The 10 blocks remain unfreed, until once saved and blender reopened.

Brecht Van Lommel commented

2019-04-04 23:55:02 +02:00

Added subscriber: @brecht

Brecht Van Lommel commented

2019-04-04 23:55:02 +02:00

Changed status from 'Open' to: 'Resolved'

Brecht Van Lommel closed this issue

2019-04-04 23:55:02 +02:00

Brecht Van Lommel commented

2019-04-04 23:55:02 +02:00

With the extrude bug fixed I think we can close this issue.

Brecht Van Lommel changed title from ~~Blender 2.8 "ctrl+z" crashes, segmentation fault~~ to Grease pencil extrude generates broken vertex weights

2019-04-04 23:55:19 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Grease pencil extrude generates broken vertex weights #62872