Crash in undoing switch from sculpt to edit mode and back. #81854

New Issue

Bastien Montagne · 2020-10-19T16:10:22+02:00

Bastien Montagne commented

2020-10-19 16:10:22 +02:00

Current Blender master.

With an ASAN build, default startup:

switch cube to sculpt mode.
switch cube to edit mode.
switch cube to sculpt mode.
undo the last two operation (i.e. undo twice).

=================================================================
==116736==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160007970bc at pc 0x00001060bbbd bp 0x7ffc33c5b3e0 sp 0x7ffc33c5b3d8
READ of size 1 at 0x6160007970bc thread T0
    - 0 0x1060bbbc in BKE_sculpt_update_object_before_eval /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683
    - 1 0x100475fe in mesh_build_data /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1772
    - 2 0x100495ed in mesh_get_eval_final /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1952
    - 3 0x1060c3ab in BKE_sculpt_update_object_for_edit /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1744
    - 4 0x15347a6a in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8110
    - 5 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181
    - 6 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    - 7 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    - 8 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    - 9 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    - 10 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    - 11 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    - 12 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    - 13 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    - 14 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    - 15 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    - 16 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    - 17 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    - 18 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    - 19 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    - 20 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    - 21 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    - 22 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308
    - 23 0xfd4b029 in _start (/home/bastien/blender/build_master_debug/bin/blender+0xfd4b029)

0x6160007970bc is located 572 bytes inside of 576-byte region [0x616000796e80,0x6160007970c0)
freed by thread T0 here:
    - 0 0x7f1cacc70b6f in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
    - 1 0x28a161be in MEM_lockfree_freeN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    - 2 0x106079da in BKE_sculptsession_free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1428
    - 3 0x15348139 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8171
    - 4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    - 5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    - 6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    - 7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    - 8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    - 9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    - 10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    - 11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    - 12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    - 13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    - 14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    - 15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    - 16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    - 17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    - 18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    - 19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    - 0 0x7f1cacc71037 in calloc (/lib/x86_64-linux-gnu/libasan.so.6+0xaa037)
    - 1 0x28a1689c in MEM_lockfree_callocN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:235
    - 2 0x15347917 in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8108
    - 3 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181
    - 4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    - 5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    - 6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    - 7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    - 8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    - 9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    - 10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    - 11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    - 12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    - 13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    - 14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    - 15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    - 16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    - 17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    - 18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    - 19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683 in BKE_sculpt_update_object_before_eval
Shadow bytes around the buggy address:
  0x0c2c800eadc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800eadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eadf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2c800eae10: fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa fa fa
  0x0c2c800eae20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800eae30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==116736==ABORTING

Root of the issue is that ED_object_sculptmode_enter_ex frees sculptsession, then calls sculpt_init_session which ends up using evaluated object that still has that sculptsession pointer in it, since depsgraph is not updated at all in the mean time.

Current Blender master. With an ASAN build, default startup: - switch cube to sculpt mode. - switch cube to edit mode. - switch cube to sculpt mode. - undo the last two operation (i.e. undo twice). ```lines=20 ================================================================= ==116736==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160007970bc at pc 0x00001060bbbd bp 0x7ffc33c5b3e0 sp 0x7ffc33c5b3d8 READ of size 1 at 0x6160007970bc thread T0 - 0 0x1060bbbc in BKE_sculpt_update_object_before_eval /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683 - 1 0x100475fe in mesh_build_data /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1772 - 2 0x100495ed in mesh_get_eval_final /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1952 - 3 0x1060c3ab in BKE_sculpt_update_object_for_edit /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1744 - 4 0x15347a6a in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8110 - 5 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181 - 6 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493 - 7 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210 - 8 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711 - 9 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722 - 10 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727 - 11 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209 - 12 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273 - 13 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409 - 14 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290 - 15 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110 - 16 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420 - 17 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717 - 18 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841 - 19 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371 - 20 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476 - 21 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519 - 22 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308 - 23 0xfd4b029 in _start (/home/bastien/blender/build_master_debug/bin/blender+0xfd4b029) 0x6160007970bc is located 572 bytes inside of 576-byte region [0x616000796e80,0x6160007970c0) freed by thread T0 here: - 0 0x7f1cacc70b6f in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f) - 1 0x28a161be in MEM_lockfree_freeN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129 - 2 0x106079da in BKE_sculptsession_free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1428 - 3 0x15348139 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8171 - 4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493 - 5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210 - 6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711 - 7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722 - 8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727 - 9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209 - 10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273 - 11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409 - 12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290 - 13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110 - 14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420 - 15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717 - 16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841 - 17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371 - 18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476 - 19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519 #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: - 0 0x7f1cacc71037 in calloc (/lib/x86_64-linux-gnu/libasan.so.6+0xaa037) - 1 0x28a1689c in MEM_lockfree_callocN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:235 - 2 0x15347917 in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8108 - 3 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181 - 4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493 - 5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210 - 6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711 - 7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722 - 8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727 - 9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209 - 10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273 - 11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409 - 12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290 - 13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110 - 14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420 - 15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717 - 16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841 - 17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371 - 18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476 - 19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519 #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-use-after-free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683 in BKE_sculpt_update_object_before_eval Shadow bytes around the buggy address: 0x0c2c800eadc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c800eadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eadf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eae00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c2c800eae10: fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa fa fa 0x0c2c800eae20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2c800eae30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eae40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eae50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2c800eae60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==116736==ABORTING ``` Root of the issue is that `ED_object_sculptmode_enter_ex` frees sculptsession, then calls `sculpt_init_session` which ends up using evaluated object that still has that sculptsession pointer in it, since depsgraph is not updated at all in the mean time.

Bastien Montagne commented

2020-10-19 16:10:22 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'