Page MenuHome

Crash in undoing switch from sculpt to edit mode and back.
Closed, ResolvedPublicBUG

Description

Current Blender master.

With an ASAN build, default startup:

  1. switch cube to sculpt mode.
  2. switch cube to edit mode.
  3. switch cube to sculpt mode.
  4. undo the last two operation (i.e. undo twice).
=================================================================
==116736==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160007970bc at pc 0x00001060bbbd bp 0x7ffc33c5b3e0 sp 0x7ffc33c5b3d8
READ of size 1 at 0x6160007970bc thread T0
    #0 0x1060bbbc in BKE_sculpt_update_object_before_eval /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683
    #1 0x100475fe in mesh_build_data /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1772
    #2 0x100495ed in mesh_get_eval_final /home/bastien/blender/src/source/blender/blenkernel/intern/DerivedMesh.c:1952
    #3 0x1060c3ab in BKE_sculpt_update_object_for_edit /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1744
    #4 0x15347a6a in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8110
    #5 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181
    #6 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    #7 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    #8 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    #9 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    #10 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    #11 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    #12 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    #13 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    #14 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    #15 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    #16 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    #17 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    #18 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    #19 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    #20 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    #21 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    #22 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308
    #23 0xfd4b029 in _start (/home/bastien/blender/build_master_debug/bin/blender+0xfd4b029)

0x6160007970bc is located 572 bytes inside of 576-byte region [0x616000796e80,0x6160007970c0)
freed by thread T0 here:
    #0 0x7f1cacc70b6f in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xa9b6f)
    #1 0x28a161be in MEM_lockfree_freeN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    #2 0x106079da in BKE_sculptsession_free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1428
    #3 0x15348139 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8171
    #4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    #5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    #6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    #7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    #8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    #9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    #10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    #11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    #12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    #13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    #14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    #15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    #16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    #17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    #18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    #19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    #0 0x7f1cacc71037 in calloc (/lib/x86_64-linux-gnu/libasan.so.6+0xaa037)
    #1 0x28a1689c in MEM_lockfree_callocN /home/bastien/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:235
    #2 0x15347917 in sculpt_init_session /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8108
    #3 0x15348168 in ED_object_sculptmode_enter_ex /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt.c:8181
    #4 0x1548ff7d in sculpt_undosys_step_decode /home/bastien/blender/src/source/blender/editors/sculpt_paint/sculpt_undo.c:1493
    #5 0x1101a9aa in undosys_step_decode /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:210
    #6 0x1101fe50 in BKE_undosys_step_undo_with_data_ex /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:711
    #7 0x1101ff7b in BKE_undosys_step_undo_with_data /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:722
    #8 0x11020006 in BKE_undosys_step_undo /home/bastien/blender/src/source/blender/blenkernel/intern/undo_system.c:727
    #9 0x15724a13 in ed_undo_step_impl /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:209
    #10 0x15725207 in ed_undo_step_direction /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:273
    #11 0x157264b4 in ed_undo_exec /home/bastien/blender/src/source/blender/editors/undo/ed_undo.c:409
    #12 0x1103d630 in wm_operator_invoke /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:1290
    #13 0x110450f5 in wm_handler_operator_call /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2110
    #14 0x11048b40 in wm_handlers_do_keymap_with_keymap_handler /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2420
    #15 0x1104c2ba in wm_handlers_do_intern /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2717
    #16 0x1104d525 in wm_handlers_do /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:2841
    #17 0x11053b3f in wm_event_do_handlers /home/bastien/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3371
    #18 0x110192c5 in WM_main /home/bastien/blender/src/source/blender/windowmanager/intern/wm.c:476
    #19 0xfd4be30 in main /home/bastien/blender/src/source/creator/creator.c:519
    #20 0x7f1ca6611cc9 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/bastien/blender/src/source/blender/blenkernel/intern/paint.c:1683 in BKE_sculpt_update_object_before_eval
Shadow bytes around the buggy address:
  0x0c2c800eadc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800eadd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eade0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eadf0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c2c800eae10: fd fd fd fd fd fd fd[fd]fa fa fa fa fa fa fa fa
  0x0c2c800eae20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2c800eae30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2c800eae60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==116736==ABORTING

Root of the issue is that ED_object_sculptmode_enter_ex frees sculptsession, then calls sculpt_init_session which ends up using evaluated object that still has that sculptsession pointer in it, since depsgraph is not updated at all in the mean time.