Crash when baking normals from selected to active without cage #63302

New Issue

Marcin Twarowski · 2019-04-05T11:10:28+02:00

Marcin Twarowski commented

2019-04-05 11:10:28 +02:00

Windows-10-10.0.16299 64 Bits
GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 419.67

Broken: version: 2.80 (sub 53), branch: blender2.7, commit date: 2019-04-04 19:22, hash: b2e2db94bd
Worked in 2.79a

Open attached blend file. Press bake. Crash. Doesn't crash with other types of maps (diffuse, etc.). Doesn't crash in 2.79.

bake_normal_with_decimate_crash.blend

Windows-10-10.0.16299 64 Bits GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 419.67 Broken: version: 2.80 (sub 53), branch: blender2.7, commit date: 2019-04-04 19:22, hash: `b2e2db94bd` Worked in 2.79a Open attached blend file. Press bake. Crash. Doesn't crash with other types of maps (diffuse, etc.). Doesn't crash in 2.79. [bake_normal_with_decimate_crash.blend](https://archive.blender.org/developer/F6913347/bake_normal_with_decimate_crash.blend)

Marcin Twarowski commented

2019-04-05 11:10:28 +02:00

Added subscriber: @MarcinTwarowski

Dalai Felinto was assigned by Sebastian Parborg

2019-04-05 12:39:23 +02:00

Sebastian Parborg commented

2019-04-05 12:39:46 +02:00

Added subscriber: @ZedDB

Sebastian Parborg commented

2019-04-05 12:39:46 +02:00

Backtrace:

Thread 33 "blender" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffb619a700 (LWP 10124)]
0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63
63		r[0] = a[0];
(gdb) bt
- 0  0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63
- 1  0x000055555855c203 in RE_bake_normal_world_to_tangent (pixel_array=0x7fffb3000008, num_pixels=1048576, depth=4, result=0x7fffbb000008, me=0x7fffba4d7408,
    normal_swizzle=0x7fffb9b2c060, mat=0x7fffba63a8bc) at /home/zed/prog/blender/source/blender/render/intern/source/bake_api.c:810
#2  0x00005555583ac1dc in bake (re=0x7fffbe69d008, bmain=0x7fffc2a99308, scene=0x7fffbf3fb008, view_layer=0x7fffc2948f88, ob_low=0x7fffc25b5a08,
    selected_objects=0x7fffb9b2c030, reports=0x7fffd77e11c8, pass_type=SCE_PASS_NORMAL, pass_filter=-1, margin=16, save_mode=R_BAKE_SAVE_INTERNAL,
    is_clear=true, is_split_materials=false, is_automatic_name=false, is_selected_to_active=true, is_cage=true, cage_extrusion=0.0220000017, normal_space=3,
    normal_swizzle=0x7fffb9b2c060, custom_cage=0x7fffb9b2c0ac "", filepath=0x7fffb9b2c0ec "UU", width=512, height=512, identifier=0x55555cf88c03 "",
    sa=0x7fffc29dfe48, uv_layer=0x7fffb9b2c06c "") at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:937
#3  0x00005555583ad6e5 in bake_startjob (bkv=0x7fffb9b2c008, UNUSED_stop=0x7fffc24ad7bc, do_update=0x7fffc24ad7ba, progress=0x7fffc24ad7c0)
    at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:1249
- 4  0x0000555557e6e678 in do_job_thread (job_v=0x7fffc24ad748) at /home/zed/prog/blender/source/blender/windowmanager/intern/wm_jobs.c:362
- 5  0x00005555592f028a in tslot_thread_start (tslot_p=0x7fffb9b57448) at /home/zed/prog/blender/source/blender/blenlib/intern/threads.c:258
- 6  0x00007fffec4cb173 in start_thread () from /lib64/libpthread.so.0
- 7  0x00007fffebff79cf in clone () from /lib64/libc.so.6

Backtrace: ``` Thread 33 "blender" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffb619a700 (LWP 10124)] 0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63 63 r[0] = a[0]; (gdb) bt - 0 0x0000555558558eec in copy_v3_v3 (r=0x7fffb6199390, a=0x0) at /home/zed/prog/blender/source/blender/blenlib/intern/math_vector_inline.c:63 - 1 0x000055555855c203 in RE_bake_normal_world_to_tangent (pixel_array=0x7fffb3000008, num_pixels=1048576, depth=4, result=0x7fffbb000008, me=0x7fffba4d7408, normal_swizzle=0x7fffb9b2c060, mat=0x7fffba63a8bc) at /home/zed/prog/blender/source/blender/render/intern/source/bake_api.c:810 #2 0x00005555583ac1dc in bake (re=0x7fffbe69d008, bmain=0x7fffc2a99308, scene=0x7fffbf3fb008, view_layer=0x7fffc2948f88, ob_low=0x7fffc25b5a08, selected_objects=0x7fffb9b2c030, reports=0x7fffd77e11c8, pass_type=SCE_PASS_NORMAL, pass_filter=-1, margin=16, save_mode=R_BAKE_SAVE_INTERNAL, is_clear=true, is_split_materials=false, is_automatic_name=false, is_selected_to_active=true, is_cage=true, cage_extrusion=0.0220000017, normal_space=3, normal_swizzle=0x7fffb9b2c060, custom_cage=0x7fffb9b2c0ac "", filepath=0x7fffb9b2c0ec "UU", width=512, height=512, identifier=0x55555cf88c03 "", sa=0x7fffc29dfe48, uv_layer=0x7fffb9b2c06c "") at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:937 #3 0x00005555583ad6e5 in bake_startjob (bkv=0x7fffb9b2c008, UNUSED_stop=0x7fffc24ad7bc, do_update=0x7fffc24ad7ba, progress=0x7fffc24ad7c0) at /home/zed/prog/blender/source/blender/editors/object/object_bake_api.c:1249 - 4 0x0000555557e6e678 in do_job_thread (job_v=0x7fffc24ad748) at /home/zed/prog/blender/source/blender/windowmanager/intern/wm_jobs.c:362 - 5 0x00005555592f028a in tslot_thread_start (tslot_p=0x7fffb9b57448) at /home/zed/prog/blender/source/blender/blenlib/intern/threads.c:258 - 6 0x00007fffec4cb173 in start_thread () from /lib64/libpthread.so.0 - 7 0x00007fffebff79cf in clone () from /lib64/libc.so.6 ```

Dalai Felinto commented

2019-06-28 15:41:33 +02:00

The crash happens even when no decimator modifier is present.

Dalai Felinto commented

2019-06-28 15:43:55 +02:00

The current error I get is:
SUMMARY: AddressSanitizer: heap-use-after-free //source/blender/blenkernel/intern/library.c:607 in BKE_id_copy_is_allowed
Full ASAN report: P1014

The current error I get is: `SUMMARY: AddressSanitizer: heap-use-after-free //source/blender/blenkernel/intern/library.c:607 in BKE_id_copy_is_allowed` Full ASAN report: [P1014](https://archive.blender.org/developer/P1014.txt)

Marcin Twarowski commented

2019-06-28 15:49:18 +02:00

I just tested it with newest build and it sometimes works fine, sometimes bakes broken normalmap. But usually crashes. It's true, now it crashes without decimate too.

Michell commented

2019-06-28 16:18:10 +02:00

Added subscriber: @Michell

Michell commented

2019-06-28 16:18:10 +02:00

First of all, I thank you very much for your patience and attention

@dalai-1 Felinto (dfelinto)
hi, please i have a offtopic question
how can I download svn from 279//, my school project is in 2.79 and I can not find it, I need the code and not the compilation, since my project focused on this and I profi my laptop, I could not recover my information and it would be a lot of work to return to change everything and I do not have so much time, my graduation is very close and I want to deliver in time for a good grade
I would like to have time to change to 2.8 but it is impossible for me, it is my one year job and I can not do it in 2 months once more

First of all, I thank you very much for your patience and attention @dalai-1 Felinto (dfelinto) hi, please i have a **offtopic question** **how can I download svn from 279**//, my school project is in 2.79 and I can not find it, I need the code and not the compilation, since my project focused on this and I profi my laptop, I could not recover my information and it would be a lot of work to return to change everything and I do not have so much time, my graduation is very close and I want to deliver in time for a good grade I would like to have time to change to 2.8 but it is impossible for me, it is my one year job and I can not do it in 2 months once more

Bastien Montagne commented

2019-06-28 16:25:58 +02:00

Added subscriber: @mont29

Bastien Montagne commented

2019-06-28 16:25:58 +02:00

@Michell Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through devtalk or ML (bf-committers@blender.org).

And Blender source is on git, not svn, you can either access the 2.7x branch, or the 2.79b release tag.

@Michell Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through [devtalk](https://devtalk.blender.org) or ML (bf-committers@blender.org). And Blender source is on git, not svn, you can either access the [2.7x branch](https:*developer.blender.org/diffusion/B/history/blender2.7/), or the [2.79b release tag](https:*developer.blender.org/diffusion/B/history/master/;v2.79b).

Dalai Felinto commented

2019-06-28 16:27:52 +02:00

This comment was removed by @dfelinto

*This comment was removed by @dfelinto*

Dalai Felinto commented

2019-06-28 17:42:46 +02:00

Changed status from 'Open' to: 'Resolved'

Dalai Felinto closed this issue

2019-06-28 17:42:46 +02:00

Dalai Felinto removed their assignment 2019-06-28 17:42:46 +02:00

Sergey Sharybin was assigned by Dalai Felinto

2019-06-28 17:42:46 +02:00

Dalai Felinto commented

2019-06-28 17:42:46 +02:00

Added subscribers: @Sergey, @dfelinto

Dalai Felinto commented

2019-06-28 17:42:46 +02:00

So what is happening here is:

Mesh *me_low = BKE_object_to_mesh(NULL, ob_low_eval, false); // called from bake > bake_mesh_new_from_object
BKE_object_eval_reset(ob_low_eval); // called from bake
BKE_mesh_copy_for_eval(me_low, false); // called from bake > RE_bake_normal_world_to_tangent

I'm not sure what is the best course of action here. For instance we could copy the cage eval (P1016) but I'm pretty sure this violates DEG design and it leads to asan crash on blender exit.
@Sergey thoughts?

So what is happening here is: 1. Mesh *me_low = BKE_object_to_mesh(NULL, ob_low_eval, false); // called from bake > bake_mesh_new_from_object 2. BKE_object_eval_reset(ob_low_eval); // called from bake 3. BKE_mesh_copy_for_eval(me_low, false); // called from bake > RE_bake_normal_world_to_tangent I'm not sure what is the best course of action here. For instance we could copy the cage eval ([P1016](https://archive.blender.org/developer/P1016.txt)) but I'm pretty sure this violates DEG design and it leads to asan crash on blender exit. @Sergey thoughts?

Dalai Felinto changed title from ~~crash when baking normals from selected to active when active object has decimate modifier~~ to Crash when baking normals from selected to active without cage

2019-06-28 17:43:58 +02:00

Dalai Felinto commented

2019-06-28 17:54:25 +02:00

Changed status from 'Resolved' to: 'Open'

Dalai Felinto reopened this issue

2019-06-28 17:54:25 +02:00

Sergey Sharybin commented

2019-06-28 18:01:45 +02:00

@dfelinto, quick though is to use BKE_mesh_new_from_object() directly.

@dfelinto, quick though is to use `BKE_mesh_new_from_object()` directly.

Michell commented

2019-06-28 18:12:47 +02:00

In #63302#708663, @mont29 wrote:
@Michell Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through devtalk or ML (bf-committers@blender.org).

And Blender source is on git, not svn, you can either access the 2.7x branch, or the 2.79b release tag.

please give them an apology for my audacity, you are the ones who know more about this topic and if you guide me I know I can be a good blender contributor, I did not know how to approach this community I still do not know many things about the subject

> In #63302#708663, @mont29 wrote: > @Michell Please use this bug tracker for reporting bugs. General discussion and inquiries like that shall go through [devtalk](https://devtalk.blender.org) or ML (bf-committers@blender.org). > > And Blender source is on git, not svn, you can either access the [2.7x branch](https:*developer.blender.org/diffusion/B/history/blender2.7/), or the [2.79b release tag](https:*developer.blender.org/diffusion/B/history/master/;v2.79b). please give them an apology for my audacity, you are the ones who know more about this topic and if you guide me I know I can be a good blender contributor, I did not know how to approach this community I still do not know many things about the subject

Michell commented

2019-06-28 18:15:59 +02:00

Added subscriber: @dalai-1

Sergey Sharybin removed their assignment 2019-07-01 12:11:40 +02:00

Dalai Felinto was assigned by Sergey Sharybin

2019-07-01 12:11:40 +02:00

Sergey Sharybin commented

2019-07-01 12:11:40 +02:00

@dfelinto, here is a patch which fixes heap-use-after-free caused by my recent changes in the object-to-mesh area: P1017.

Unfortunately, there is something else involved here: different parts of baking seems to use different objects or meshes, making the lo-poly mesh to contain modifiers in some cases but not contain them in others.
This doesn't seem to be caused by my changes and i can not really follow the code there. Removing the Decimate modifier from low-poly mesh solves the crash.

@dfelinto, here is a patch which fixes heap-use-after-free caused by my recent changes in the object-to-mesh area: [P1017](https://archive.blender.org/developer/P1017.txt). Unfortunately, there is something else involved here: different parts of baking seems to use different objects or meshes, making the lo-poly mesh to contain modifiers in some cases but not contain them in others. This doesn't seem to be caused by my changes and i can not really follow the code there. Removing the Decimate modifier from low-poly mesh solves the crash.

Dalai Felinto removed their assignment 2019-07-02 23:00:32 +02:00

Sergey Sharybin was assigned by Dalai Felinto

2019-07-02 23:00:32 +02:00

Dalai Felinto commented

2019-07-02 23:00:32 +02:00

@Sergey: me_cage should have the same totloop and totpoly as me_low. We even check for that when users set the cage manually.

Easy to spot with this P1021 / P1022 (P1017 + P1021).

For some reason me_cage (inside the is_cage loop) does not compute the decimator modifier when we do BKE_mesh_new_from_object or BKE_object_to_mesh.

2.79 compatible sample files

Simple object with decimator modifier:
bake-279-decimator.blend
Edge Split modifier test:
bake-279-edge-split.blend

HP: High poly Object
LP-control: Control object, no modifier.
LP-modifier: Edge-Split modifier, should bake same as LP-control.
LP-applied: Edge-Split modifier applied, should bake differently.

The latter is important to test if the cage mesh was properly generated without eventual edge split modifiers in the low poly object.

@Sergey: *me_cage* should have the same *totloop* and *totpoly* as *me_low*. We even check for that when users set the cage manually. Easy to spot with this [P1021](https://archive.blender.org/developer/P1021.txt) / [P1022](https://archive.blender.org/developer/P1022.txt) ([P1017](https://archive.blender.org/developer/P1017.txt) + [P1021](https://archive.blender.org/developer/P1021.txt)). For some reason `me_cage` (inside the is_cage loop) does not compute the decimator modifier when we do *BKE_mesh_new_from_object* or *BKE_object_to_mesh*. **2.79 compatible sample files** * Simple object with decimator modifier: [bake-279-decimator.blend](https://archive.blender.org/developer/F7562633/bake-279-decimator.blend) * Edge Split modifier test: [bake-279-edge-split.blend](https://archive.blender.org/developer/F7562635/bake-279-edge-split.blend) *HP*: High poly Object *LP-control*: Control object, no modifier. *LP-modifier*: Edge-Split modifier, should bake same as *LP-control*. *LP-applied*: Edge-Split modifier applied, should bake differently. The latter is important to test if the cage mesh was properly generated without eventual edge split modifiers in the low poly object.

Sergey Sharybin commented

2019-07-02 23:56:16 +02:00

@dfelinto, from the comment of BKE_mesh_new_from_object: Create new mesh from the given object at its current state.
Now, i see the code in baker is poking around modifying modifier settings and resetting evaluated state of the object. So the following code is lacking prior to BKE_mesh_new_from_object () (note that my snipped from previous comment must be applied):

/* Make sure object is evaluated with the new modifier settings.

NOTE: Since the dependnecy graph was fully evaluated prior to bake, and we only made single
modification to this object all the possible dependnecies for evaluation are already up to date.
This means we can do cheap single object update (as an opposite of full depsgraph update). */

BKE_object_handle_data_update(depsgraph, scene_eval, ob_low_eval);

You can additionally add a flag is_changed and only reset evaluation state and re-evaluated the object if you actually disabled EdgeSplit modifier.

@dfelinto, from the comment of `BKE_mesh_new_from_object`: Create new mesh from the given object at its current state. Now, i see the code in baker is poking around modifying modifier settings and resetting evaluated state of the object. So the following code is lacking prior to `BKE_mesh_new_from_object ()` (note that my snipped from previous comment must be applied): ``` /* Make sure object is evaluated with the new modifier settings. ``` * * NOTE: Since the dependnecy graph was fully evaluated prior to bake, and we only made single * modification to this object all the possible dependnecies for evaluation are already up to date. * This means we can do cheap single object update (as an opposite of full depsgraph update). */ ``` BKE_object_handle_data_update(depsgraph, scene_eval, ob_low_eval); ``` You can additionally add a flag `is_changed` and only reset evaluation state and re-evaluated the object if you actually disabled EdgeSplit modifier.

blender-admin commented

2019-07-03 00:26:53 +02:00

This issue was referenced by 50ccbe6bb2

This issue was referenced by 50ccbe6bb2339ac132298305f8782bec4a6da079

Dalai Felinto commented

2019-07-03 00:34:07 +02:00

Changed status from 'Open' to: 'Resolved'

Dalai Felinto closed this issue

2019-07-03 00:34:07 +02:00

Dalai Felinto commented

2019-07-03 00:35:08 +02:00

All good now, thanks Sergey!

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when baking normals from selected to active without cage #63302