Crash after removing a "target" from any search button [e.g.UVMap node] and clicking again on the same button #75325

New Issue

TheRedWaxPolice · 2020-04-02T23:36:23+02:00

TheRedWaxPolice commented

2020-04-02 23:36:23 +02:00

System Information
Win 10

Blender Version
Broken: blender-2.83-a9963669f9d2-windows64
Worked: Not sure...

Short description of error
On nodes that have that "target" field (like the UVMap node etc), when you choose something from the list and then remove it by clicking on the (X) sign, if you don't move the mouse and click again on the same spot, blender crashes..

Exact steps for others to reproduce the error
In the shader editor, add a UVMap node, choose the uvmap in the "target" list, then remove it by clicking on (X). And without moving your mouse (or at least dont move it outside the button), click again on the same spot. Crash.
Double click on the (X) does the same thing..

See:

Untitled.mp4

**System Information** Win 10 **Blender Version** Broken: blender-2.83-a9963669f9d2-windows64 Worked: Not sure... **Short description of error** On nodes that have that "target" field (like the UVMap node etc), when you choose something from the list and then remove it by clicking on the (X) sign, if you don't move the mouse and click again on the same spot, blender crashes.. **Exact steps for others to reproduce the error** In the shader editor, add a UVMap node, choose the uvmap in the "target" list, then remove it by clicking on (X). And without moving your mouse (or at least dont move it outside the button), click again on the same spot. Crash. Double click on the (X) does the same thing.. See: [Untitled.mp4](https://archive.blender.org/developer/F8444875/Untitled.mp4)

TheRedWaxPolice commented

2020-04-02 23:36:23 +02:00

Added subscriber: @TheRedWaxPolice

blender-admin commented

2020-04-02 23:36:23 +02:00

#75345 was marked as duplicate of this issue

Philipp Oeser commented

2020-04-03 10:25:41 +02:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2020-04-03 10:25:41 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Philipp Oeser self-assigned this 2020-04-03 10:25:41 +02:00

Philipp Oeser commented

2020-04-03 10:25:41 +02:00

Confirmed, checking...

Philipp Oeser removed their assignment 2020-04-03 14:11:39 +02:00

Philipp Oeser commented

2020-04-03 14:11:39 +02:00

Added subscribers: @JulianEisel, @ideasman42

Philipp Oeser commented

2020-04-03 14:11:39 +02:00

Caused by c46dcdf887

Since above commit, ui_apply_but_funcs_after will free the buttons search_arg
Then back and forth between restoring search_arg while drawing UI_but_func_search_set() and freeing again ui_apply_but_func()
Not really sure how to reliably ensure UI_but_func_search_set is called last...

So here, but->search_arg is NULL

1  ui_rna_collection_search_cb interface_utils.c         399   0x1617183 
2  ui_searchbox_update         interface_region_search.c 379   0x15fa734 
3  ui_textedit_begin           interface_handlers.c      3368  0x15b9759 
4  button_activate_state       interface_handlers.c      7850  0x15c69c8 
5  ui_do_but_TEX               interface_handlers.c      4393  0x15bbf37 
6  ui_do_but_SEARCH_UNLINK     interface_handlers.c      4421  0x15bc04d 
7  ui_do_button                interface_handlers.c      7553  0x15c5eec 
8  ui_handle_button_event      interface_handlers.c      8702  0x15c8941 
9  ui_region_handler           interface_handlers.c      10623 0x15cd137 
10 wm_handler_ui_call          wm_event_system.c         617   0xab73e0  
11 wm_handlers_do_intern       wm_event_system.c         2724  0xabca1c  
12 wm_handlers_do              wm_event_system.c         2835  0xabce41  
13 wm_event_do_handlers        wm_event_system.c         3304  0xabe40f  
14 WM_main                     wm.c                      447   0xab27fe  
15 main                        creator.c                 524   0x672a39

Crash could of course be prevented like so
P1321: #75325 bandaid



diff --git a/source/blender/editors/interface/interface_utils.c b/source/blender/editors/interface/interface_utils.c
index a69837e9b51..c178fd5507b 100644
--- a/source/blender/editors/interface/interface_utils.c
+++ b/source/blender/editors/interface/interface_utils.c
@@ -396,6 +396,12 @@ void ui_rna_collection_search_cb(const struct bContext *C,
 {
   uiRNACollectionSearch *data = arg;
   char *name;
+
+  if (data == NULL) {
+    printf("%s: called with invalid but->search_arg\n", __func__);
+    return;
+  }
+
   int i = 0, iconid = 0, flag = RNA_property_flag(data->target_prop);
   ListBase *items_list = MEM_callocN(sizeof(ListBase), "items_list");
   CollItemSearch *cis;

But I guess there are better ways to solve this, @ideasman42, @JulianEisel?
Will set to Hig priority since it is a crash and it affects all search menus...

Caused by c46dcdf887 Since above commit, `ui_apply_but_funcs_after` will free the buttons `search_arg` Then back and forth between restoring `search_arg` while drawing `UI_but_func_search_set()` and freeing again `ui_apply_but_func()` Not really sure how to reliably ensure `UI_but_func_search_set` is called last... So here, `but->search_arg` is NULL ``` 1 ui_rna_collection_search_cb interface_utils.c 399 0x1617183 2 ui_searchbox_update interface_region_search.c 379 0x15fa734 3 ui_textedit_begin interface_handlers.c 3368 0x15b9759 4 button_activate_state interface_handlers.c 7850 0x15c69c8 5 ui_do_but_TEX interface_handlers.c 4393 0x15bbf37 6 ui_do_but_SEARCH_UNLINK interface_handlers.c 4421 0x15bc04d 7 ui_do_button interface_handlers.c 7553 0x15c5eec 8 ui_handle_button_event interface_handlers.c 8702 0x15c8941 9 ui_region_handler interface_handlers.c 10623 0x15cd137 10 wm_handler_ui_call wm_event_system.c 617 0xab73e0 11 wm_handlers_do_intern wm_event_system.c 2724 0xabca1c 12 wm_handlers_do wm_event_system.c 2835 0xabce41 13 wm_event_do_handlers wm_event_system.c 3304 0xabe40f 14 WM_main wm.c 447 0xab27fe 15 main creator.c 524 0x672a39 ``` Crash could of course be prevented like so [P1321: #75325 bandaid](https://archive.blender.org/developer/P1321.txt) ``` diff --git a/source/blender/editors/interface/interface_utils.c b/source/blender/editors/interface/interface_utils.c index a69837e9b51..c178fd5507b 100644 --- a/source/blender/editors/interface/interface_utils.c +++ b/source/blender/editors/interface/interface_utils.c @@ -396,6 +396,12 @@ void ui_rna_collection_search_cb(const struct bContext *C, { uiRNACollectionSearch *data = arg; char *name; + + if (data == NULL) { + printf("%s: called with invalid but->search_arg\n", __func__); + return; + } + int i = 0, iconid = 0, flag = RNA_property_flag(data->target_prop); ListBase *items_list = MEM_callocN(sizeof(ListBase), "items_list"); CollItemSearch *cis; ``` But I guess there are better ways to solve this, @ideasman42, @JulianEisel? Will set to Hig priority since it is a crash and it affects all search menus...

Philipp Oeser changed title from ~~Crash after removing a "target" from a node and clicking again on the same spot~~ to Crash after removing a "target" from any search button [e.g.UVMap node] and clicking again on the same button

2020-04-03 14:13:22 +02:00

Philipp Oeser commented

2020-04-03 15:48:45 +02:00

Added subscriber: @Raulus

Roman Markov commented

2020-04-04 15:08:18 +02:00

Added subscriber: @unwave

Roman Markov commented

2020-04-04 15:08:18 +02:00

Does not crash:
2.83 (sub 6), branch: master, commit date: 2020-03-09 13:47, hash: 598ab525da
2.82 (sub 7), branch: master, commit date: 2020-03-12 05:06, hash: 375c7dc4ca

Crash:
2.83 (sub 11), branch: master, commit date: 2020-04-03 21:41, hash: 7c0e285948

Does not crash: 2.83 (sub 6), branch: master, commit date: 2020-03-09 13:47, hash: `598ab525da` 2.82 (sub 7), branch: master, commit date: 2020-03-12 05:06, hash: `375c7dc4ca` Crash: 2.83 (sub 11), branch: master, commit date: 2020-04-03 21:41, hash: `7c0e285948`

Philipp Oeser commented

2020-04-04 15:37:29 +02:00

thx investigating, we already know the commit that causes the issue (see above)