Page MenuHome

File Selector Crashes Showing Thumbnails
Closed, ResolvedPublicBUG

Description

This bug is difficult to redo, however I've run into it a few times when testing the sequencer, which happens to have the file-selector open.

There is a double free in the file-selector code.

  • Open the Video Editor template.
  • Navigate the file selector to a directory containing images (only ~8 in my case).
  • Add sequence strips, drag them around, undo, redo... duplicate.
  • Eventually I get crash with Asan that reports a double-free.
=================================================================
==49913==ERROR: AddressSanitizer: heap-use-after-free on address 0x619000b9d188 at pc 0x5564099caacf bp 0x7f6538c54450 sp 0x7f6538c54440
READ of size 4 at 0x619000b9d188 thread T14
    #0 0x5564099caace in filelist_cache_preview_freef /src/blender/source/blender/editors/space_file/filelist.c:1299
    #1 0x55640a359cd2 in task_data_free /src/blender/source/blender/blenlib/intern/task.c:235
    #2 0x55640a359cd2 in task_free /src/blender/source/blender/blenlib/intern/task.c:301
    #3 0x55640a35c509 in task_scheduler_thread_run /src/blender/source/blender/blenlib/intern/task.c:454
    #4 0x7f655c70146e in start_thread (/usr/lib/libpthread.so.0+0x946e)
    #5 0x7f655af973d2 in clone (/usr/lib/libc.so.6+0xff3d2)

0x619000b9d188 is located 1032 bytes inside of 1048-byte region [0x619000b9cd80,0x619000b9d198)
freed by thread T0 here:
    #0 0x7f655cb28720 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:122
    #1 0x55640a390b84 in MEM_lockfree_freeN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:157
    #2 0x5564099d4de9 in filelist_cache_previews_update /src/blender/source/blender/editors/space_file/filelist.c:2140
    #3 0x55640999c63b in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:732
    #4 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504
    #5 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534
    #6 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640
    #7 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776
    #8 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958
    #9 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448
    #10 0x556403848bae in main /src/blender/source/creator/creator.c:522
    #11 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

previously allocated by thread T0 here:
    #0 0x7f655cb28b3a in __interceptor_malloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:144
    #1 0x55640a391697 in MEM_lockfree_mallocN /src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:308
    #2 0x5564099cb77f in filelist_cache_previews_push /src/blender/source/blender/editors/space_file/filelist.c:1364
    #3 0x5564099d42e1 in filelist_file_cache_block /src/blender/source/blender/editors/space_file/filelist.c:2059
    #4 0x55640999c567 in file_draw_list /src/blender/source/blender/editors/space_file/file_draw.c:727
    #5 0x556409a032b6 in file_main_region_draw /src/blender/source/blender/editors/space_file/space_file.c:504
    #6 0x5564064c92f6 in ED_region_do_draw /src/blender/source/blender/editors/screen/area.c:534
    #7 0x556404635010 in wm_draw_window_offscreen /src/blender/source/blender/windowmanager/intern/wm_draw.c:640
    #8 0x556404636491 in wm_draw_window /src/blender/source/blender/windowmanager/intern/wm_draw.c:776
    #9 0x5564046379ea in wm_draw_update /src/blender/source/blender/windowmanager/intern/wm_draw.c:958
    #10 0x5564046271f0 in WM_main /src/blender/source/blender/windowmanager/intern/wm.c:448
    #11 0x556403848bae in main /src/blender/source/creator/creator.c:522
    #12 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

Thread T14 created by T0 here:
    #0 0x7f655ca52377 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:208
    #1 0x55640a35d83d in BLI_task_scheduler_create /src/blender/source/blender/blenlib/intern/task.c:517
    #2 0x55640a3724bf in BLI_task_scheduler_get /src/blender/source/blender/blenlib/intern/threads.c:177
    #3 0x55640a369e93 in BLI_task_parallel_range /src/blender/source/blender/blenlib/intern/task.c:1316
    #4 0x5564088935af in flush_prepare /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:113
    #5 0x5564088935af in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /src/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:353
    #6 0x556408745822 in DEG_evaluate_on_refresh /src/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:63
    #7 0x556403f43623 in scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1314
    #8 0x556403f4373c in BKE_scene_graph_update_tagged /src/blender/source/blender/blenkernel/intern/scene.c:1353
    #9 0x55640463ae5f in wm_event_do_depsgraph /src/blender/source/blender/windowmanager/intern/wm_event_system.c:359
    #10 0x556404677e37 in wm_file_read_post /src/blender/source/blender/windowmanager/intern/wm_files.c:557
    #11 0x55640467acf0 in wm_homefile_read /src/blender/source/blender/windowmanager/intern/wm_files.c:1067
    #12 0x55640469ef3e in WM_init /src/blender/source/blender/windowmanager/intern/wm_init_exit.c:292
    #13 0x5564038489dd in main /src/blender/source/creator/creator.c:443
    #14 0x7f655aebf022 in __libc_start_main (/usr/lib/libc.so.6+0x27022)

SUMMARY: AddressSanitizer: heap-use-after-free /src/blender/source/blender/editors/space_file/filelist.c:1299 in filelist_cache_preview_freef
Shadow bytes around the buggy address:
  0x0c328016b9e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016b9f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c328016ba20: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c328016ba30: fd[fd]fd fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c328016ba80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

The asan report is fairly clear, uploading this in case it helps resolve the issue.

If this issue isn't helpful to keep open (as its difficult to redo) can be closed too.

Event Timeline

Bastien Montagne (mont29) changed the task status from Needs Triage to Needs Developer to Reproduce.Mar 10 2020, 9:36 AM
Bastien Montagne (mont29) updated the task description. (Show Details)
Bastien Montagne (mont29) changed the subtype of this task from "Report" to "Bug".

Tried to reproduce here with debug ASAN build, with no luck, not a single crash...

However, from the ASAN backtrace I think I understand what is going on here - some super unlikely concurrent situation indeed could lead to accessing freed memory, am preparing a fix for that, and hopefully you'll be able to confirm it works then.

Bastien Montagne (mont29) changed the task status from Needs Developer to Reproduce to Needs Information from User.Mar 13 2020, 3:29 PM
Bastien Montagne (mont29) moved this task from Backlog to Bugs on the Pipeline, Assets & I/O board.
Bastien Montagne (mont29) closed this task as Resolved.Mar 20 2020, 6:32 PM

No news for a week, so assuming this has been fixed for now.