Page MenuHome

Crash when baking normals from selected to active without cage
Closed, ResolvedPublic

Description

Windows-10-10.0.16299 64 Bits
GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 419.67

Broken: version: 2.80 (sub 53), branch: blender2.7, commit date: 2019-04-04 19:22, hash: rBb2e2db94bdae
Worked in 2.79a

Open attached blend file. Press bake. Crash. Doesn't crash with other types of maps (diffuse, etc.). Doesn't crash in 2.79.

Event Timeline

Sebastian Parborg (zeddb) lowered the priority of this task from Needs Triage by Developer to Confirmed, Medium.

Backtrace:

Thread 33 "blender" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb619a700 (LWP 10124)]
0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63
63		r[0] = a[0];
(gdb) bt
#0  0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63
#1  0x000055555855c203 in RE_bake_normal_world_to_tangent (pixel_array=0x7fffb3000008, num_pixels=1048576, depth=4, result=0x7fffbb000008, me=0x7fffba4d7408,
    normal_swizzle=0x7fffb9b2c060, mat=0x7fffba63a8bc) at /home/zed/prog/blender/source/blender/render/intern/source/bake_api.c:810
#2  0x00005555583ac1dc in bake (re=0x7fffbe69d008, bmain=0x7fffc2a99308, scene=0x7fffbf3fb008, view_layer=0x7fffc2948f88, ob_low=0x7fffc25b5a08,
    selected_objects=0x7fffb9b2c030, reports=0x7fffd77e11c8, pass_type=SCE_PASS_NORMAL, pass_filter=-1, margin=16, save_mode=R_BAKE_SAVE_INTERNAL,
    is_clear=true, is_split_materials=false, is_automatic_name=false, is_selected_to_active=true, is_cage=true, cage_extrusion=0.0220000017, normal_space=3,
    normal_swizzle=0x7fffb9b2c060, custom_cage=0x7fffb9b2c0ac "", filepath=0x7fffb9b2c0ec "UU", width=512, height=512, identifier=0x55555cf88c03 "",
    sa=0x7fffc29dfe48, uv_layer=0x7fffb9b2c06c "") at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:937
#3  0x00005555583ad6e5 in bake_startjob (bkv=0x7fffb9b2c008, UNUSED_stop=0x7fffc24ad7bc, do_update=0x7fffc24ad7ba, progress=0x7fffc24ad7c0)
    at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:1249
#4  0x0000555557e6e678 in do_job_thread (job_v=0x7fffc24ad748) at /home/zed/prog/blender/source/blender/windowmanager/intern/wm_jobs.c:362
#5  0x00005555592f028a in tslot_thread_start (tslot_p=0x7fffb9b57448) at /home/zed/prog/blender/source/blender/blenlib/intern/threads.c:258
#6  0x00007fffec4cb173 in start_thread () from /lib64/libpthread.so.0
#7  0x00007fffebff79cf in clone () from /lib64/libc.so.6

The crash happens even when no decimator modifier is present.

The current error I get is:
SUMMARY: AddressSanitizer: heap-use-after-free //source/blender/blenkernel/intern/library.c:607 in BKE_id_copy_is_allowed
Full ASAN report: P1014

I just tested it with newest build and it sometimes works fine, sometimes bakes broken normalmap. But usually crashes. It's true, now it crashes without decimate too.

First of all, I thank you very much for your patience and attention

@Felix Schlitter (dalai) Felinto (dfelinto)
hi, please i have a offtopic question
how can I download svn from 279//, my school project is in 2.79 and I can not find it, I need the code and not the compilation, since my project focused on this and I profi my laptop, I could not recover my information and it would be a lot of work to return to change everything and I do not have so much time, my graduation is very close and I want to deliver in time for a good grade
I would like to have time to change to 2.8 but it is impossible for me, it is my one year job and I can not do it in 2 months once more

@Michell (Michell) Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through devtalk or ML (bf-committers@blender.org).

And Blender source is on git, not svn, you can either access the 2.7x branch, or the 2.79b release tag.

This comment was removed by Dalai Felinto (dfelinto).
Dalai Felinto (dfelinto) closed this task as Resolved.Jun 28 2019, 5:42 PM

So what is happening here is:

  1. Mesh *me_low = BKE_object_to_mesh(NULL, ob_low_eval, false); // called from bake > bake_mesh_new_from_object
  2. BKE_object_eval_reset(ob_low_eval); // called from bake
  3. BKE_mesh_copy_for_eval(me_low, false); // called from bake > RE_bake_normal_world_to_tangent

I'm not sure what is the best course of action here. For instance we could copy the cage eval (P1016) but I'm pretty sure this violates DEG design and it leads to asan crash on blender exit.
@Sergey Sharybin (sergey) thoughts?

Dalai Felinto (dfelinto) renamed this task from crash when baking normals from selected to active when active object has decimate modifier to Crash when baking normals from selected to active without cage.Jun 28 2019, 5:43 PM
Dalai Felinto (dfelinto) raised the priority of this task from Confirmed, Medium to Confirmed, High.

@Dalai Felinto (dfelinto), quick though is to use BKE_mesh_new_from_object() directly.

Michell (Michell) added a comment.EditedJun 28 2019, 6:12 PM

@Michell (Michell) Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through devtalk or ML (bf-committers@blender.org).
And Blender source is on git, not svn, you can either access the 2.7x branch, or the 2.79b release tag.

please give them an apology for my audacity, you are the ones who know more about this topic and if you guide me I know I can be a good blender contributor, I did not know how to approach this community I still do not know many things about the subject

@Dalai Felinto (dfelinto), here is a patch which fixes heap-use-after-free caused by my recent changes in the object-to-mesh area: P1017.

Unfortunately, there is something else involved here: different parts of baking seems to use different objects or meshes, making the lo-poly mesh to contain modifiers in some cases but not contain them in others.
This doesn't seem to be caused by my changes and i can not really follow the code there. Removing the Decimate modifier from low-poly mesh solves the crash.

@Sergey Sharybin (sergey): me_cage should have the same totloop and totpoly as me_low. We even check for that when users set the cage manually.

Easy to spot with this P1021 / P1022 (P1017 + P1021).

For some reason me_cage (inside the is_cage loop) does not compute the decimator modifier when we do BKE_mesh_new_from_object or BKE_object_to_mesh.

2.79 compatible sample files

  • Simple object with decimator modifier:

  • Edge Split modifier test:

HP: High poly Object
LP-control: Control object, no modifier.
LP-modifier: Edge-Split modifier, should bake same as LP-control.
LP-applied: Edge-Split modifier applied, should bake differently.

The latter is important to test if the cage mesh was properly generated without eventual edge split modifiers in the low poly object.

@Dalai Felinto (dfelinto), from the comment of BKE_mesh_new_from_object: Create new mesh from the given object at its current state.
Now, i see the code in baker is poking around modifying modifier settings and resetting evaluated state of the object. So the following code is lacking prior to BKE_mesh_new_from_object () (note that my snipped from previous comment must be applied):

/* Make sure object is evaluated with the new modifier settings.
 *
 * NOTE: Since the dependnecy graph was fully evaluated prior to bake, and we only made single
 * modification to this object all the possible dependnecies for evaluation are already up to date.
 * This means we can do cheap single object update (as an opposite of full depsgraph update). */
BKE_object_handle_data_update(depsgraph, scene_eval, ob_low_eval);

You can additionally add a flag is_changed and only reset evaluation state and re-evaluated the object if you actually disabled EdgeSplit modifier.

All good now, thanks Sergey!