Crash undo/redo in the text editor #67045

New Issue

Campbell Barton · 2019-07-16T11:24:33+02:00

Campbell Barton commented

2019-07-16 11:24:33 +02:00

Reporting this for reference - for the diff that resolves the issue.

Make a new text data block.
Hold down a key (add many characters, 60 for eg).
Move the cube.
Hold down Ctrl-Z (it may crash)
Hold down Ctrl-Shift-Z (it may crash)

This doesn't always crash, but it does often enough.

Tested with b0b2546d4a3a308da19d218d919915aac4834e59

==21530==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110005d8508 at pc 0x564e80bdf612 bp 0x7ffe8fa74870 sp 0x7ffe8fa74860
READ of size 8 at 0x6110005d8508 thread T0
    - 0 0x564e80bdf611 in txt_move_to /src/blender/source/blender/blenkernel/intern/text.c:1177
    - 1 0x564e80bf0d79 in txt_do_redo /src/blender/source/blender/blenkernel/intern/text.c:2505
    - 2 0x564e84992534 in text_undosys_step_decode_redo_impl /src/blender/source/blender/editors/space_text/text_undo.c:127
    - 3 0x564e84992fed in text_undosys_step_decode_redo /src/blender/source/blender/editors/space_text/text_undo.c:169
    - 4 0x564e84993156 in text_undosys_step_decode /src/blender/source/blender/editors/space_text/text_undo.c:190
    - 5 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207
    - 6 0x564e84a52047 in BKE_undosys_step_redo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:774
    - 7 0x564e84a52166 in BKE_undosys_step_redo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:784
    - 8 0x564e84a521fe in BKE_undosys_step_redo /src/blender/source/blender/blenkernel/intern/undo_system.c:789
    - 9 0x564e849951b0 in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:192
    - 10 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252
    - 11 0x564e8499735b in ed_redo_exec /src/blender/source/blender/editors/undo/ed_undo.c:415
    - 12 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450
    - 13 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275
    - 14 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555
    - 15 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692
    - 16 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945
    - 17 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427
    - 18 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417
    - 19 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500
    - 20 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2)
    - 21 0x564e8000d04d in _start (/src/cmake_debug/bin/blender+0x91ae04d)

0x6110005d8508 is located 200 bytes inside of 232-byte region [0x6110005d8440,0x6110005d8528)
freed by thread T0 here:
    - 0 0x7fc4dffe06c0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
    - 1 0x564e8142b00e in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:157
    - 2 0x564e805adf9b in BKE_id_free_ex /src/blender/source/blender/blenkernel/intern/library_remap.c:980
    - 3 0x564e805c95bd in BKE_main_free /src/blender/source/blender/blenkernel/intern/main.c:74
    - 4 0x564e80283fa7 in BKE_blender_globals_clear /src/blender/source/blender/blenkernel/intern/blender.c:147
    - 5 0x564e849e8418 in setup_app_data /src/blender/source/blender/blenkernel/intern/blendfile.c:251
    - 6 0x564e849e99e6 in setup_app_blend_file_data /src/blender/source/blender/blenkernel/intern/blendfile.c:384
    - 7 0x564e849ea600 in BKE_blendfile_read_from_memfile /src/blender/source/blender/blenkernel/intern/blendfile.c:486
    - 8 0x564e849e61de in BKE_memfile_undo_decode /src/blender/source/blender/blenkernel/intern/blender_undo.c:79
    - 9 0x564e8499ba58 in memfile_undosys_step_decode /src/blender/source/blender/editors/undo/memfile_undo.c:92
    - 10 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207
    - 11 0x564e84a52047 in BKE_undosys_step_redo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:774
    - 12 0x564e84a52166 in BKE_undosys_step_redo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:784
    - 13 0x564e84a521fe in BKE_undosys_step_redo /src/blender/source/blender/blenkernel/intern/undo_system.c:789
    - 14 0x564e849951b0 in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:192
    - 15 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252
    - 16 0x564e8499735b in ed_redo_exec /src/blender/source/blender/editors/undo/ed_undo.c:415
    - 17 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450
    - 18 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275
    - 19 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555
    - 20 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692
    - 21 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945
    - 22 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427
    - 23 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417
    - 24 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500
    - 25 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2)

previously allocated by thread T0 here:
    - 0 0x7fc4dffe0ada in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:144
    - 1 0x564e8142bb21 in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:308
    - 2 0x564e800351af in read_struct /src/blender/source/blender/blenloader/intern/readfile.c:2266
    - 3 0x564e800b93f8 in read_libblock /src/blender/source/blender/blenloader/intern/readfile.c:9109
    - 4 0x564e800c08eb in blo_read_file_internal /src/blender/source/blender/blenloader/intern/readfile.c:9718
    - 5 0x564e801fd7c2 in BLO_read_from_memfile /src/blender/source/blender/blenloader/intern/readblenentry.c:401
    - 6 0x564e849ea246 in BKE_blendfile_read_from_memfile /src/blender/source/blender/blenkernel/intern/blendfile.c:475
    - 7 0x564e849e61de in BKE_memfile_undo_decode /src/blender/source/blender/blenkernel/intern/blender_undo.c:79
    - 8 0x564e8499ba58 in memfile_undosys_step_decode /src/blender/source/blender/editors/undo/memfile_undo.c:92
    - 9 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207
    - 10 0x564e84a51165 in BKE_undosys_step_undo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:707
    - 11 0x564e84a512ae in BKE_undosys_step_undo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:718
    - 12 0x564e84a51346 in BKE_undosys_step_undo /src/blender/source/blender/blenkernel/intern/undo_system.c:723
    - 13 0x564e8499511c in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:189
    - 14 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252
    - 15 0x564e84996f35 in ed_undo_exec /src/blender/source/blender/editors/undo/ed_undo.c:388
    - 16 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450
    - 17 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275
    - 18 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555
    - 19 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692
    - 20 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945
    - 21 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427
    - 22 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417
    - 23 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500
    #24 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2)

SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/blenkernel/intern/text.c:1177 in txt_move_to

*Reporting this for reference - for the diff that resolves the issue.* - Make a new text data block. - Hold down a key (add many characters, 60 for eg). - Move the cube. - Hold down Ctrl-Z (it may crash) - Hold down Ctrl-Shift-Z (it may crash) This doesn't always crash, but it does often enough. Tested with `b0b2546d4a3a308da19d218d919915aac4834e59` ``` ==21530==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110005d8508 at pc 0x564e80bdf612 bp 0x7ffe8fa74870 sp 0x7ffe8fa74860 READ of size 8 at 0x6110005d8508 thread T0 - 0 0x564e80bdf611 in txt_move_to /src/blender/source/blender/blenkernel/intern/text.c:1177 - 1 0x564e80bf0d79 in txt_do_redo /src/blender/source/blender/blenkernel/intern/text.c:2505 - 2 0x564e84992534 in text_undosys_step_decode_redo_impl /src/blender/source/blender/editors/space_text/text_undo.c:127 - 3 0x564e84992fed in text_undosys_step_decode_redo /src/blender/source/blender/editors/space_text/text_undo.c:169 - 4 0x564e84993156 in text_undosys_step_decode /src/blender/source/blender/editors/space_text/text_undo.c:190 - 5 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207 - 6 0x564e84a52047 in BKE_undosys_step_redo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:774 - 7 0x564e84a52166 in BKE_undosys_step_redo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:784 - 8 0x564e84a521fe in BKE_undosys_step_redo /src/blender/source/blender/blenkernel/intern/undo_system.c:789 - 9 0x564e849951b0 in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:192 - 10 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252 - 11 0x564e8499735b in ed_redo_exec /src/blender/source/blender/editors/undo/ed_undo.c:415 - 12 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450 - 13 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275 - 14 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555 - 15 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692 - 16 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945 - 17 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427 - 18 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417 - 19 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500 - 20 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2) - 21 0x564e8000d04d in _start (/src/cmake_debug/bin/blender+0x91ae04d) 0x6110005d8508 is located 200 bytes inside of 232-byte region [0x6110005d8440,0x6110005d8528) freed by thread T0 here: - 0 0x7fc4dffe06c0 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122 - 1 0x564e8142b00e in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:157 - 2 0x564e805adf9b in BKE_id_free_ex /src/blender/source/blender/blenkernel/intern/library_remap.c:980 - 3 0x564e805c95bd in BKE_main_free /src/blender/source/blender/blenkernel/intern/main.c:74 - 4 0x564e80283fa7 in BKE_blender_globals_clear /src/blender/source/blender/blenkernel/intern/blender.c:147 - 5 0x564e849e8418 in setup_app_data /src/blender/source/blender/blenkernel/intern/blendfile.c:251 - 6 0x564e849e99e6 in setup_app_blend_file_data /src/blender/source/blender/blenkernel/intern/blendfile.c:384 - 7 0x564e849ea600 in BKE_blendfile_read_from_memfile /src/blender/source/blender/blenkernel/intern/blendfile.c:486 - 8 0x564e849e61de in BKE_memfile_undo_decode /src/blender/source/blender/blenkernel/intern/blender_undo.c:79 - 9 0x564e8499ba58 in memfile_undosys_step_decode /src/blender/source/blender/editors/undo/memfile_undo.c:92 - 10 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207 - 11 0x564e84a52047 in BKE_undosys_step_redo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:774 - 12 0x564e84a52166 in BKE_undosys_step_redo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:784 - 13 0x564e84a521fe in BKE_undosys_step_redo /src/blender/source/blender/blenkernel/intern/undo_system.c:789 - 14 0x564e849951b0 in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:192 - 15 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252 - 16 0x564e8499735b in ed_redo_exec /src/blender/source/blender/editors/undo/ed_undo.c:415 - 17 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450 - 18 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275 - 19 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555 - 20 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692 - 21 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945 - 22 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427 - 23 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417 - 24 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500 - 25 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2) previously allocated by thread T0 here: - 0 0x7fc4dffe0ada in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:144 - 1 0x564e8142bb21 in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:308 - 2 0x564e800351af in read_struct /src/blender/source/blender/blenloader/intern/readfile.c:2266 - 3 0x564e800b93f8 in read_libblock /src/blender/source/blender/blenloader/intern/readfile.c:9109 - 4 0x564e800c08eb in blo_read_file_internal /src/blender/source/blender/blenloader/intern/readfile.c:9718 - 5 0x564e801fd7c2 in BLO_read_from_memfile /src/blender/source/blender/blenloader/intern/readblenentry.c:401 - 6 0x564e849ea246 in BKE_blendfile_read_from_memfile /src/blender/source/blender/blenkernel/intern/blendfile.c:475 - 7 0x564e849e61de in BKE_memfile_undo_decode /src/blender/source/blender/blenkernel/intern/blender_undo.c:79 - 8 0x564e8499ba58 in memfile_undosys_step_decode /src/blender/source/blender/editors/undo/memfile_undo.c:92 - 9 0x564e84a4aa66 in undosys_step_decode /src/blender/source/blender/blenkernel/intern/undo_system.c:207 - 10 0x564e84a51165 in BKE_undosys_step_undo_with_data_ex /src/blender/source/blender/blenkernel/intern/undo_system.c:707 - 11 0x564e84a512ae in BKE_undosys_step_undo_with_data /src/blender/source/blender/blenkernel/intern/undo_system.c:718 - 12 0x564e84a51346 in BKE_undosys_step_undo /src/blender/source/blender/blenkernel/intern/undo_system.c:723 - 13 0x564e8499511c in ed_undo_step_impl /src/blender/source/blender/editors/undo/ed_undo.c:189 - 14 0x564e84995a9d in ed_undo_step_direction /src/blender/source/blender/editors/undo/ed_undo.c:252 - 15 0x564e84996f35 in ed_undo_exec /src/blender/source/blender/editors/undo/ed_undo.c:388 - 16 0x564e81f35e8b in wm_operator_invoke /src/blender/source/blender/windowmanager/intern/wm_event_system.c:1450 - 17 0x564e81f3e5cb in wm_handler_operator_call /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2275 - 18 0x564e81f414ab in wm_handlers_do_keymap_with_keymap_handler /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2555 - 19 0x564e81f42eb3 in wm_handlers_do_intern /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2692 - 20 0x564e81f461d6 in wm_handlers_do /src/blender/source/blender/windowmanager/intern/wm_event_system.c:2945 - 21 0x564e81f4c995 in wm_event_do_handlers /src/blender/source/blender/windowmanager/intern/wm_event_system.c:3427 - 22 0x564e81f1084e in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:417 - 23 0x564e8000dd19 in main /src/blender/source/creator/creator.c:500 #24 0x7fc4deeceee2 in __libc_start_main (/usr/lib/libc.so.6+0x26ee2) SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/blenkernel/intern/text.c:1177 in txt_move_to ```

Campbell Barton commented

2019-07-16 11:24:34 +02:00

Added subscriber: @ideasman42

Campbell Barton self-assigned this 2019-07-16 11:25:13 +02:00

Campbell Barton commented

2019-07-17 13:23:16 +02:00

Changed status from 'Open' to: 'Resolved'

Campbell Barton closed this issue

2019-07-17 13:23:16 +02:00

Campbell Barton commented

2019-07-17 13:23:16 +02:00

Fixed by 366865dd02