Page MenuHome

[2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes
Closed, ResolvedPublicBUG

Description

System Information
Operating system: Windows-10-10.0.18362-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 442.19

Blender Version
Broken: version: 2.90.0 Alpha, branch: master, commit date: 2020-06-27 21:56, hash: rB59d2dd2237ce
Broken: version: 2.83.1, branch: master, commit date: 2020-06-25 09:47, hash: rB8289fc688b3e
Worked: 2.82 (sub 7), branch: master, commit date: 2020-02-12 16:20, hash: rB77d23b0bd76f

Short description of error
Crashes when undo/ redo enters and exits different modes; tested with object and edit mode on default startup file and consistently crashes.

Exact steps for others to reproduce the error

  • select default cube and press (tab) several times to cycle modes from object to edit mode (3-4 times or more)
  • undo shortcut (ctrl z) several times (3-4 times or more causes crash)
  • redo shortcut (ctrl shift z) crashes blender (always crashes on the 3rd or 4th redo on my system)

Based on the default 2.83.1 and 2.9 startup files; tested on 2.82 with 256 undo/ redo steps without any crashes.

Event Timeline

Reproduced. Crashes on redo. No crash with Preferences > Experimental > Undo Legacy.

Stack trace:

>	ui_but_value_get(but=0x000001b9137e2e48) Line 2378
 	ui_but_is_pushed_ex(but=0x000001b9137e2e48, value=0x00000063c4bfea70) Line 2002
 	[Inline Frame] ui_but_update_select_flag() Line 2086
 	ui_but_update_ex(but=0x000001b9137e2e48, validate) Line 3506
 	[Inline Frame] ui_but_update() Line 3676
 	[Inline Frame] ui_but_update_and_icon_set() Line 4631
 	uiDefIconBut(block, type, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5019
 	uiDefIconButBit(block=0x000001b9137b3a38, type, bit, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5057
 	uiTemplateEditModeSelection(layout=0x000001b913436f68, C) Line 162
 	uiTemplateHeader3D_mode(layout=0x000001b913436f68, C=0x000001b904858c18) Line 238
 	RNA_function_call(C, reports, ptr, func, parms=0x00000063c4bfef88) Line 7494
 	pyrna_func_call(self, args, kw=0x0000000000000000) Line 6328
 	[External Code]	
 	bpy_class_call(C=0x000001b904858c18, ptr=0x00000063c4bff950, func=0x00007ff6ceeff300, parms=0x00000063c4bff968) Line 8513
 	header_draw(C=0x000001b904858c18, hdr=0x00000063c4bff9f0) Line 707
 	ED_region_header_layout(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2872
 	ED_region_header(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2935
 	ED_region_do_draw(C=0x000001b904858c18, region=0x000001b9074367f8) Line 543
 	wm_draw_window_offscreen(C=0x000001b904858c18, win=0x000001b906eaa2b8, stereo) Line 713
 	wm_draw_window(C=0x000001b904858c18, win=0x000001b906eaa2b8) Line 841
 	wm_draw_update(C=0x000001b904858c18) Line 1042
 	WM_main(C=0x000001b904858c18) Line 482
 	main(argc=1, UNUSED_argv_c=0x0000000000000000) Line 534
 	[External Code]

This:

diff --git a/source/blender/editors/space_view3d/view3d_header.c b/source/blender/editors/space_view3d/view3d_header.c
index f2e42cd1725..3668c3060a2 100644
--- a/source/blender/editors/space_view3d/view3d_header.c
+++ b/source/blender/editors/space_view3d/view3d_header.c
@@ -136,11 +136,34 @@ void uiTemplateEditModeSelection(uiLayout *layout, struct bContext *C)

   UI_block_func_handle_set(block, do_view3d_header_buttons, NULL);

+  //////////////////////////////////////////////////////////////////////////////////////////
+  printf("Entered uiTemplateEditModeSelection in %s\n", CTX_data_mode_string(C));
+  //////////////////////////////////////////////////////////////////////////////////////////
+
   if (obedit && (obedit->type == OB_MESH)) {
     BMEditMesh *em = BKE_editmesh_from_object(obedit);
     uiLayout *row;
     uiBut *but;

+    //////////////////////////////////////////////////////////////////////////////////////////
+    if (BKE_editmesh_from_object(CTX_data_edit_object(C)) == NULL) {
+      printf("Context says we're in %s\n", CTX_data_mode_string(C));
+      printf("But there's no edit object editmesh\n");
+      printf("em=%x, &em-selectmode=%x\n", em, &em->selectmode);
+      printf("If we continue execution, we will crash in ui_but_value_get() Line 2378\n");
+      printf("Because it will try to access (short *)but->poin\n");
+      printf("which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode\n");
+      printf("and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL\n");
+      printf("So I'm going to return now.\n");
+      printf("Notice how the viewport mode button is now broken.\n");
+      printf("Also all further redos will fail here.\n");
+      printf("An attempt to switch the mode (using tab or the button) may crash or recover\n");
+      printf("from this broken state.\n");
+      return;
+    }
+    //////////////////////////////////////////////////////////////////////////////////////////
+
     row = uiLayoutRow(layout, true);
     block = uiLayoutGetBlock(row);
     but = uiDefIconButBitS(

will give following output (just hitting Ctrl+Shift+Z after tabbing a bunch of times, and undoing it all):

Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in mesh_edit
Context says we're in mesh_edit
But there's no edit object editmesh
em=0, &em-selectmode=68
If we continue execution, we will crash in ui_but_value_get() Line 2378
Because it will try to access (short *)but->poin
which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode
and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL
So I'm going to return now.
Notice how the viewport mode button is now broken.
Also all further redos will fail here.
An attempt to switch the mode (using tab or the button) may crash or recover
from this broken state.

So in the last "bad" redo the context got messed up, indicating that we're in edit mode, when we should've been and indeed are in object mode (notice the switches edit-object-edit-edit).

Hi Vincent, thanks for your feedback, great to know legacy undo doesn't have the same issue, I just tried it and it works as expected.

Richard Antalik (ISS) changed the task status from Needs Triage to Confirmed.Jul 1 2020, 2:31 AM
Hans Goudey (HooglyBoogly) triaged this task as High priority.Tue, Sep 8, 11:04 PM
Hans Goudey (HooglyBoogly) changed the subtype of this task from "Report" to "Bug".

I can reproduce this easily by holding down tab so it quickly cycles between modes on the default cube, then undoing a few times, then redoing.

This seems more like an undo bug though, so I'm tagging the correct project.

This also applies to 2.90

Hans Goudey (HooglyBoogly) renamed this task from Crash on undo/ redo while changing modes to [2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes.Tue, Sep 8, 11:08 PM

@Hans Goudey (HooglyBoogly) when merging tasks remember to bring over the relevant information to the one that remains open.

As mentioned in T80377 simpler/exact steps to reproduce as well as assigning to Bastien since it is "new" undo related:

I can reproduce with the following:

  • Tab
  • Tab
  • Tab
  • Tab
  • Ctrl + Z (undo)
  • Shift Ctrl + Z (redo)