Crash on Assign Automatic Weights operator #78796

New Issue

Demeter Dzadik · 2020-07-10T15:35:28+02:00

Demeter Dzadik commented

2020-07-10 15:35:28 +02:00

System Information
Operating system: Linux-5.3.0-7629-generic-x86_64-with-debian-buster-sid 64 Bits
Graphics card: GeForce RTX 2080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 440.44

Blender Version
Broken: version: 2.90.0 Alpha, branch: HEAD (modified), commit date: 2020-07-10 12:40, hash: 26d28ade26

Short description of error
Blender crashes or sometimes hangs infinitely when assigning automatic weights to a chain of 3 or more bendy bones. The console spams messages such as:
Malloc returns null: len=40 in realloc, total 30024304
Then sometimes segfaults, sometimes just hangs.

Exact steps for others to reproduce the error
bbone_autoweight_crash.blend

Open file
Ctrl+P -> With Automatic Weights
Crash.

If you change the last bone's BBone segments to 1, no crash.

**System Information** Operating system: Linux-5.3.0-7629-generic-x86_64-with-debian-buster-sid 64 Bits Graphics card: GeForce RTX 2080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 440.44 **Blender Version** Broken: version: 2.90.0 Alpha, branch: HEAD (modified), commit date: 2020-07-10 12:40, hash: `26d28ade26` **Short description of error** Blender crashes or sometimes hangs infinitely when assigning automatic weights to a chain of 3 or more bendy bones. The console spams messages such as: `Malloc returns null: len=40 in realloc, total 30024304` Then sometimes segfaults, sometimes just hangs. **Exact steps for others to reproduce the error** [bbone_autoweight_crash.blend](https://archive.blender.org/developer/F8683776/bbone_autoweight_crash.blend) - Open file - Ctrl+P -> With Automatic Weights - Crash. If you change the last bone's BBone segments to 1, no crash.

Demeter Dzadik commented

2020-07-10 15:35:28 +02:00

Added subscriber: @Mets

Philipp Oeser commented

2020-07-10 17:08:00 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Brecht Van Lommel commented

2020-07-10 18:23:48 +02:00

Added subscribers: @Jeroen-Bakker, @brecht

Brecht Van Lommel commented

2020-07-10 18:23:48 +02:00

Caused by 39b525e0f0, which was reverted.

=================================================================
==213088==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400006a2f8 at pc 0x7ffff760ff40 bp 0x7fffffffb7e0 sp 0x7fffffffaf88
READ of size 22 at 0x60400006a2f8 thread T0
    - 0 0x7ffff760ff3f in __interceptor_memmove (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xa0f3f)
    - 1 0x2c6d747 in BKE_defvert_remove_group /home/brecht/dev/worktree/source/blender/blenkernel/intern/deform.c:838
    - 2 0x5b7210e in ED_vgroup_vert_remove /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:916
    - 3 0x738f511 in heat_bone_weighting /home/brecht/dev/worktree/source/blender/editors/armature/meshlaplacian.c:822
    - 4 0x737d4a7 in add_verts_to_dgroups /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:441
    - 5 0x737da55 in ED_object_vgroup_calc_from_armature /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:506
    - 6 0x5af3a9a in ED_object_parent_set /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:887
    - 7 0x5af5444 in parent_set_exec /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:998
    - 8 0x2fae18b in wm_operator_invoke /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1296
    - 9 0x2fafc1b in wm_operator_call_internal /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1498
    - 10 0x2faff3e in WM_operator_name_call_ptr /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1546
    - 11 0x635c625 in ui_apply_but_funcs_after /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:902
    - 12 0x63e6d45 in ui_popup_handler /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:10878
    - 13 0x2fa6fed in wm_handler_ui_call /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:622
    - 14 0x2fbdaaa in wm_handlers_do_intern /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2743
    - 15 0x2fbeba7 in wm_handlers_do /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2854
    - 16 0x2fc44f0 in wm_event_do_handlers /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:3283
    - 17 0x2f91cf0 in WM_main /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm.c:475
    - 18 0x1aad789 in main /home/brecht/dev/worktree/source/creator/creator.c:532
    - 19 0x7ffff6e350b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #20 0x1aacabd in _start (/home/brecht/dev/worktree_debug/bin/blender+0x1aacabd)

0x60400006a2f8 is located 0 bytes to the right of 40-byte region [0x60400006a2d0,0x60400006a2f8)
allocated by thread T0 here:
    - 0 0x7ffff767cdc6 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    - 1 0x12f66f09 in MEM_lockfree_callocN /home/brecht/dev/worktree/intern/guardedalloc/intern/mallocn_lockfree_impl.c:232
    - 2 0x2c6ce51 in BKE_defvert_add_index_notest /home/brecht/dev/worktree/source/blender/blenkernel/intern/deform.c:801
    - 3 0x5b71a94 in ED_vgroup_nr_vert_add /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:857
    - 4 0x5b71df2 in ED_vgroup_vert_add /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:887
    - 5 0x738eacd in heat_bone_weighting /home/brecht/dev/worktree/source/blender/editors/armature/meshlaplacian.c:775
    - 6 0x737d4a7 in add_verts_to_dgroups /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:441
    - 7 0x737da55 in ED_object_vgroup_calc_from_armature /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:506
    - 8 0x5af3a9a in ED_object_parent_set /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:887
    - 9 0x5af5444 in parent_set_exec /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:998
    - 10 0x2fae18b in wm_operator_invoke /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1296
    - 11 0x2fafc1b in wm_operator_call_internal /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1498
    - 12 0x2faff3e in WM_operator_name_call_ptr /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1546
    - 13 0x635c625 in ui_apply_but_funcs_after /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:902
    - 14 0x63e6d45 in ui_popup_handler /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:10878
    - 15 0x2fa6fed in wm_handler_ui_call /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:622
    - 16 0x2fbdaaa in wm_handlers_do_intern /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2743
    - 17 0x2fbeba7 in wm_handlers_do /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2854
    - 18 0x2fc44f0 in wm_event_do_handlers /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:3283
    - 19 0x2f91cf0 in WM_main /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm.c:475
    - 20 0x1aad789 in main /home/brecht/dev/worktree/source/creator/creator.c:532
    - 21 0x7ffff6e350b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Caused by 39b525e0f0, which was reverted. ``` ================================================================= ==213088==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60400006a2f8 at pc 0x7ffff760ff40 bp 0x7fffffffb7e0 sp 0x7fffffffaf88 READ of size 22 at 0x60400006a2f8 thread T0 - 0 0x7ffff760ff3f in __interceptor_memmove (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xa0f3f) - 1 0x2c6d747 in BKE_defvert_remove_group /home/brecht/dev/worktree/source/blender/blenkernel/intern/deform.c:838 - 2 0x5b7210e in ED_vgroup_vert_remove /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:916 - 3 0x738f511 in heat_bone_weighting /home/brecht/dev/worktree/source/blender/editors/armature/meshlaplacian.c:822 - 4 0x737d4a7 in add_verts_to_dgroups /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:441 - 5 0x737da55 in ED_object_vgroup_calc_from_armature /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:506 - 6 0x5af3a9a in ED_object_parent_set /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:887 - 7 0x5af5444 in parent_set_exec /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:998 - 8 0x2fae18b in wm_operator_invoke /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1296 - 9 0x2fafc1b in wm_operator_call_internal /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1498 - 10 0x2faff3e in WM_operator_name_call_ptr /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1546 - 11 0x635c625 in ui_apply_but_funcs_after /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:902 - 12 0x63e6d45 in ui_popup_handler /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:10878 - 13 0x2fa6fed in wm_handler_ui_call /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:622 - 14 0x2fbdaaa in wm_handlers_do_intern /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2743 - 15 0x2fbeba7 in wm_handlers_do /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2854 - 16 0x2fc44f0 in wm_event_do_handlers /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:3283 - 17 0x2f91cf0 in WM_main /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm.c:475 - 18 0x1aad789 in main /home/brecht/dev/worktree/source/creator/creator.c:532 - 19 0x7ffff6e350b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) #20 0x1aacabd in _start (/home/brecht/dev/worktree_debug/bin/blender+0x1aacabd) 0x60400006a2f8 is located 0 bytes to the right of 40-byte region [0x60400006a2d0,0x60400006a2f8) allocated by thread T0 here: - 0 0x7ffff767cdc6 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6) - 1 0x12f66f09 in MEM_lockfree_callocN /home/brecht/dev/worktree/intern/guardedalloc/intern/mallocn_lockfree_impl.c:232 - 2 0x2c6ce51 in BKE_defvert_add_index_notest /home/brecht/dev/worktree/source/blender/blenkernel/intern/deform.c:801 - 3 0x5b71a94 in ED_vgroup_nr_vert_add /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:857 - 4 0x5b71df2 in ED_vgroup_vert_add /home/brecht/dev/worktree/source/blender/editors/object/object_vgroup.c:887 - 5 0x738eacd in heat_bone_weighting /home/brecht/dev/worktree/source/blender/editors/armature/meshlaplacian.c:775 - 6 0x737d4a7 in add_verts_to_dgroups /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:441 - 7 0x737da55 in ED_object_vgroup_calc_from_armature /home/brecht/dev/worktree/source/blender/editors/armature/armature_skinning.c:506 - 8 0x5af3a9a in ED_object_parent_set /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:887 - 9 0x5af5444 in parent_set_exec /home/brecht/dev/worktree/source/blender/editors/object/object_relations.c:998 - 10 0x2fae18b in wm_operator_invoke /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1296 - 11 0x2fafc1b in wm_operator_call_internal /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1498 - 12 0x2faff3e in WM_operator_name_call_ptr /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:1546 - 13 0x635c625 in ui_apply_but_funcs_after /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:902 - 14 0x63e6d45 in ui_popup_handler /home/brecht/dev/worktree/source/blender/editors/interface/interface_handlers.c:10878 - 15 0x2fa6fed in wm_handler_ui_call /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:622 - 16 0x2fbdaaa in wm_handlers_do_intern /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2743 - 17 0x2fbeba7 in wm_handlers_do /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:2854 - 18 0x2fc44f0 in wm_event_do_handlers /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm_event_system.c:3283 - 19 0x2f91cf0 in WM_main /home/brecht/dev/worktree/source/blender/windowmanager/intern/wm.c:475 - 20 0x1aad789 in main /home/brecht/dev/worktree/source/creator/creator.c:532 - 21 0x7ffff6e350b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) ```

Sybren A. Stüvel commented

2020-07-21 15:54:54 +02:00

Added subscriber: @dr.sybren

Sybren A. Stüvel commented

2020-07-21 15:54:54 +02:00

Changed status from 'Confirmed' to: 'Resolved'

Sybren A. Stüvel closed this issue

2020-07-21 15:54:54 +02:00

Sybren A. Stüvel self-assigned this 2020-07-21 15:54:54 +02:00

Sybren A. Stüvel commented

2020-07-21 15:54:54 +02:00

Closing as Resolved as the crash is no longer there (because of the revert).

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash on Assign Automatic Weights operator #78796