Crash on linked scene reload while this scene is active #83592

Closed
opened 2020-12-09 15:17:59 +01:00 by Yegor · 25 comments

System Information
Operating system: Linux-5.4.0-53-generic-x86_64-with-debian-bullseye-sid 64 Bits
Graphics card: GeForce GTX 1080 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 450.80.02

Blender Version
Broken: version: 2.92.0 Alpha, branch: master, commit date: 2020-12-04 15:45, hash: 1d2c70d761, 2.91.0

Short description of error
Crash on linked scene reload if the linked scene is active.

Exact steps for others to reproduce the error

  • Link any scene from any file

  • Make that scene active from the top right scene selection dialog

  • Go to the outliner "blender file" mode

  • Right click on the linked library

  • Reload -> crash

**System Information** Operating system: Linux-5.4.0-53-generic-x86_64-with-debian-bullseye-sid 64 Bits Graphics card: GeForce GTX 1080 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 450.80.02 **Blender Version** Broken: version: 2.92.0 Alpha, branch: master, commit date: 2020-12-04 15:45, hash: `1d2c70d761`, 2.91.0 **Short description of error** Crash on linked scene reload if the linked scene is active. **Exact steps for others to reproduce the error** - Link any scene from any file - Make that scene active from the top right scene selection dialog - Go to the outliner "blender file" mode - Right click on the linked library - Reload -> crash
Author

Added subscriber: @YegorSmirnov

Added subscriber: @YegorSmirnov
Member

Added subscriber: @lichtwerk

Added subscriber: @lichtwerk
Member

Changed status from 'Needs Triage' to: 'Confirmed'

Changed status from 'Needs Triage' to: 'Confirmed'
Member

Can confirm.
Surprised this has not come up before.

Looks like the scene does not have a default view layer yet in BKE_view_layer_default_view

1   raise                                                  0x7ffff781e9d5 
2   abort                                                  0x7ffff78078a4 
3   _BLI_assert_abort             BLI_assert.c        50   0xdd17454      
4   BKE_view_layer_default_view   layer.c             125  0x3400435      
5   CTX_data_view_layer           context.c           1047 0x33aabbd      
6   editarm_object_from_context   editarmature_undo.c 113  0x4b25df4      
7   armature_undosys_poll         editarmature_undo.c 146  0x4b25ed1      
8   BKE_undosys_type_from_context undo_system.c       115  0x4aaa124      
9   BKE_undosys_step_push         undo_system.c       599  0x4aaba06      
10  ED_undo_push                  ed_undo.c           153  0x4775720      
11  ED_undo_push_op               ed_undo.c           347  0x4776040      
12  wm_operator_finished          wm_event_system.c   935  0x3924d22      
13  wm_operator_invoke            wm_event_system.c   1329 0x3925dc3      
14  wm_operator_call_internal     wm_event_system.c   1534 0x39263c4      
15  WM_operator_name_call_ptr     wm_event_system.c   1548 0x392645b      
16  lib_relocate                  outliner_edit.c     894  0x4920cb8      
17  lib_reload_fn                 outliner_edit.c     1037 0x4921211      
18  outliner_do_libdata_operation outliner_tools.c    403  0x49095a2      
19  outliner_lib_operation_exec   outliner_tools.c    2207 0x490d570    
                                                             
Can confirm. Surprised this has not come up before. Looks like the scene does not have a default view layer yet in `BKE_view_layer_default_view` ``` 1 raise 0x7ffff781e9d5 2 abort 0x7ffff78078a4 3 _BLI_assert_abort BLI_assert.c 50 0xdd17454 4 BKE_view_layer_default_view layer.c 125 0x3400435 5 CTX_data_view_layer context.c 1047 0x33aabbd 6 editarm_object_from_context editarmature_undo.c 113 0x4b25df4 7 armature_undosys_poll editarmature_undo.c 146 0x4b25ed1 8 BKE_undosys_type_from_context undo_system.c 115 0x4aaa124 9 BKE_undosys_step_push undo_system.c 599 0x4aaba06 10 ED_undo_push ed_undo.c 153 0x4775720 11 ED_undo_push_op ed_undo.c 347 0x4776040 12 wm_operator_finished wm_event_system.c 935 0x3924d22 13 wm_operator_invoke wm_event_system.c 1329 0x3925dc3 14 wm_operator_call_internal wm_event_system.c 1534 0x39263c4 15 WM_operator_name_call_ptr wm_event_system.c 1548 0x392645b 16 lib_relocate outliner_edit.c 894 0x4920cb8 17 lib_reload_fn outliner_edit.c 1037 0x4921211 18 outliner_do_libdata_operation outliner_tools.c 403 0x49095a2 19 outliner_lib_operation_exec outliner_tools.c 2207 0x490d570 ``` ```

Added subscriber: @mont29

Added subscriber: @mont29

Caused by 6be56c13e9, which is basically doing completely 100% wrong thing here... Not sure why parameter was named ngroup, this can be any ID. But new code added there is just catastrophic. Quiet obviously nobody tried those new geometry node branch in any linking context before the merge...

Caused by 6be56c13e9, which is basically doing completely 100% wrong thing here... Not sure why parameter was named `ngroup`, this can be any ID. But new code added there is just catastrophic. Quiet obviously nobody tried those new geometry node branch in any linking context before the merge...
Member

Added subscriber: @JacquesLucke

Added subscriber: @JacquesLucke
Member
CC @JacquesLucke

Added subscriber: @dfelinto

Added subscriber: @dfelinto

CC @dfelinto too re why this should have been properly reviewed instead of being rushed in in master...

CC @dfelinto too re why this should have been properly reviewed instead of being rushed in in master...
Member

@mont29: 2.91 release also crashes for me, will set back to High prio

@mont29: 2.91 release also crashes for me, will set back to High prio

Main issue fixed in 3d25312617

Remaining issue is actually not really related, and is extremely wrong operator return values introduced in ac8b641b77 and f254f66587, fix incomming.

Main issue fixed in 3d25312617 Remaining issue is actually not really related, and is extremely wrong operator return values introduced in ac8b641b77 and f254f66587, fix incomming.

Changed status from 'Confirmed' to: 'Resolved'

Changed status from 'Confirmed' to: 'Resolved'
Bastien Montagne self-assigned this 2020-12-11 11:07:43 +01:00
Member

Changed status from 'Resolved' to: 'Confirmed'

Changed status from 'Resolved' to: 'Confirmed'
Bastien Montagne was unassigned by Philipp Oeser 2020-12-11 13:21:29 +01:00
Member

@mont29: I am still getting the exact same assert as in my first reply.

This was in d72ec16e70

@mont29: I am still getting the exact same assert as in my first reply. This was in d72ec16e70

Added subscriber: @rjg

Added subscriber: @rjg

Following the steps in the ticket ASAN reports a use-after-free.

## 23664==ERROR: AddressSanitizer: heap-use-after-free on address 0x62300088b928 at pc 0x000006d6d079 bp 0x7fffffffbae0 sp 0x7fffffffbad0
READ of size 2 at 0x62300088b928 thread T0
    - 0 0x6d6d078 in rna_ID_refine /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_ID.c:444
    - 1 0x6d1398a in RNA_id_pointer_create /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_access.c:128
    - 2 0x3579148 in CTX_data_id_pointer_set /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:630
    - 3 0x7905b0e in screen_ctx_scene /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/screen/screen_context.c:125
    - 4 0x79134ad in ed_screen_context /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/screen/screen_context.c:1119
    - 5 0x3575b63 in ctx_data_get /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:351
    - 6 0x3575f6e in ctx_data_pointer_verify /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:383
    - 7 0x357cdf2 in CTX_data_scene /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:1023
    - 8 0x357cfeb in CTX_data_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:1039
    - 9 0xa07c34c in editarm_object_from_context /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/armature/editarmature_undo.c:113
    - 10 0xa07c89a in armature_undosys_poll /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/armature/editarmature_undo.c:146
    - 11 0x9e617a7 in BKE_undosys_type_from_context /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:115
    - 12 0x9e674e3 in BKE_undosys_step_push /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:599
    - 13 0x906ff62 in ED_undo_push /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/undo/ed_undo.c:153
    - 14 0x9071bfc in ED_undo_push_op /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/undo/ed_undo.c:347
    - 15 0x4f8ed60 in wm_operator_finished /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:935
    - 16 0x4f93860 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1329
    - 17 0x4f94dd8 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1534
    - 18 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    - 19 0x97f2a40 in lib_relocate /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:894
    - 20 0x97f411c in lib_reload_fn /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:1037
    - 21 0x978134c in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:403
    - 22 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407
    - 23 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407
    - 24 0x9791ea5 in outliner_lib_operation_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:2207
    - 25 0x501ca72 in WM_menu_invoke_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:962
    - 26 0x501cdf5 in WM_menu_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:982
    - 27 0x4f92d3a in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293
    - 28 0x4f94c72 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500
    - 29 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    - 30 0x9103f40 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932
    - 31 0x918e76b in ui_popup_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10901
    - 32 0x4f8c41b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636
    - 33 0x4fa25b6 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757
    - 34 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865
    - 35 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288
    - 36 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    - 37 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    - 38 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    - 39 0x34f6e6d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x34f6e6d)

0x62300088b928 is located 40 bytes inside of 6512-byte region [0x62300088b900,0x62300088d270)
freed by thread T0 here:
    - 0 0x7ffff76927cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    - 1 0x18e20f30 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    - 2 0x373d323 in BKE_id_free_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/lib_id_delete.c:188
    - 3 0x373d359 in BKE_id_free /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/lib_id_delete.c:203
    - 4 0x50b40a2 in lib_relocate_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:920
    - 5 0x50b65e4 in wm_lib_relocate_exec_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:1132
    - 6 0x50b6b8c in wm_lib_reload_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:1180
    - 7 0x4f93307 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1305
    - 8 0x4f94dd8 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1534
    - 9 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    - 10 0x97f2a40 in lib_relocate /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:894
    - 11 0x97f411c in lib_reload_fn /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:1037
    - 12 0x978134c in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:403
    - 13 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407
    - 14 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407
    - 15 0x9791ea5 in outliner_lib_operation_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:2207
    - 16 0x501ca72 in WM_menu_invoke_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:962
    - 17 0x501cdf5 in WM_menu_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:982
    - 18 0x4f92d3a in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293
    - 19 0x4f94c72 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500
    - 20 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    - 21 0x9103f40 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932
    - 22 0x918e76b in ui_popup_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10901
    - 23 0x4f8c41b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636
    - 24 0x4fa25b6 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757
    - 25 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865
    - 26 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288
    - 27 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    - 28 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    - 29 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

previously allocated by thread T0 here:
    - 0 0x7ffff7692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    - 1 0x18e21990 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    - 2 0x50db052 in read_struct /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:2109
    - 3 0x50e97bf in read_libblock /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:3525
    - 4 0x50f5c4b in link_named_part /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:4720
    - 5 0x50f6cd2 in BLO_library_link_named_part /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:4822
    - 6 0x50ae8e5 in wm_link_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:286
    - 7 0x50b07e5 in wm_link_append_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:487
    - 8 0x4f9cee3 in wm_handler_fileselect_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2306
    - 9 0x4f9e6cc in wm_handler_fileselect_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2404
    - 10 0x4fa3306 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2813
    - 11 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865
    - 12 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288
    - 13 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    - 14 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    - 15 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_ID.c:444 in rna_ID_refine
Shadow bytes around the buggy address:
  0x0c46801096d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c46801096e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c46801096f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4680109700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c4680109710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
# >0x0c4680109720: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c4680109730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4680109740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4680109750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4680109760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c4680109770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc

Following the steps in the ticket ASAN reports a use-after-free. ```lines ## 23664==ERROR: AddressSanitizer: heap-use-after-free on address 0x62300088b928 at pc 0x000006d6d079 bp 0x7fffffffbae0 sp 0x7fffffffbad0 READ of size 2 at 0x62300088b928 thread T0 - 0 0x6d6d078 in rna_ID_refine /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_ID.c:444 - 1 0x6d1398a in RNA_id_pointer_create /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_access.c:128 - 2 0x3579148 in CTX_data_id_pointer_set /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:630 - 3 0x7905b0e in screen_ctx_scene /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/screen/screen_context.c:125 - 4 0x79134ad in ed_screen_context /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/screen/screen_context.c:1119 - 5 0x3575b63 in ctx_data_get /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:351 - 6 0x3575f6e in ctx_data_pointer_verify /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:383 - 7 0x357cdf2 in CTX_data_scene /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:1023 - 8 0x357cfeb in CTX_data_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/context.c:1039 - 9 0xa07c34c in editarm_object_from_context /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/armature/editarmature_undo.c:113 - 10 0xa07c89a in armature_undosys_poll /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/armature/editarmature_undo.c:146 - 11 0x9e617a7 in BKE_undosys_type_from_context /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:115 - 12 0x9e674e3 in BKE_undosys_step_push /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/undo_system.c:599 - 13 0x906ff62 in ED_undo_push /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/undo/ed_undo.c:153 - 14 0x9071bfc in ED_undo_push_op /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/undo/ed_undo.c:347 - 15 0x4f8ed60 in wm_operator_finished /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:935 - 16 0x4f93860 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1329 - 17 0x4f94dd8 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1534 - 18 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548 - 19 0x97f2a40 in lib_relocate /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:894 - 20 0x97f411c in lib_reload_fn /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:1037 - 21 0x978134c in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:403 - 22 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407 - 23 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407 - 24 0x9791ea5 in outliner_lib_operation_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:2207 - 25 0x501ca72 in WM_menu_invoke_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:962 - 26 0x501cdf5 in WM_menu_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:982 - 27 0x4f92d3a in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293 - 28 0x4f94c72 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500 - 29 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548 - 30 0x9103f40 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932 - 31 0x918e76b in ui_popup_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10901 - 32 0x4f8c41b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636 - 33 0x4fa25b6 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757 - 34 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865 - 35 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288 - 36 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 - 37 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522 - 38 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) - 39 0x34f6e6d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x34f6e6d) 0x62300088b928 is located 40 bytes inside of 6512-byte region [0x62300088b900,0x62300088d270) freed by thread T0 here: - 0 0x7ffff76927cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) - 1 0x18e20f30 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129 - 2 0x373d323 in BKE_id_free_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/lib_id_delete.c:188 - 3 0x373d359 in BKE_id_free /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/lib_id_delete.c:203 - 4 0x50b40a2 in lib_relocate_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:920 - 5 0x50b65e4 in wm_lib_relocate_exec_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:1132 - 6 0x50b6b8c in wm_lib_reload_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:1180 - 7 0x4f93307 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1305 - 8 0x4f94dd8 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1534 - 9 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548 - 10 0x97f2a40 in lib_relocate /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:894 - 11 0x97f411c in lib_reload_fn /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_edit.c:1037 - 12 0x978134c in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:403 - 13 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407 - 14 0x9781519 in outliner_do_libdata_operation /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:407 - 15 0x9791ea5 in outliner_lib_operation_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/space_outliner/outliner_tools.c:2207 - 16 0x501ca72 in WM_menu_invoke_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:962 - 17 0x501cdf5 in WM_menu_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_operators.c:982 - 18 0x4f92d3a in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293 - 19 0x4f94c72 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500 - 20 0x4f94ed1 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548 - 21 0x9103f40 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932 - 22 0x918e76b in ui_popup_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10901 - 23 0x4f8c41b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636 - 24 0x4fa25b6 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757 - 25 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865 - 26 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288 - 27 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 - 28 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522 - 29 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) previously allocated by thread T0 here: - 0 0x7ffff7692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) - 1 0x18e21990 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276 - 2 0x50db052 in read_struct /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:2109 - 3 0x50e97bf in read_libblock /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:3525 - 4 0x50f5c4b in link_named_part /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:4720 - 5 0x50f6cd2 in BLO_library_link_named_part /home/dev/01-data/01-git/blender-git/blender/source/blender/blenloader/intern/readfile.c:4822 - 6 0x50ae8e5 in wm_link_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:286 - 7 0x50b07e5 in wm_link_append_exec /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_files_link.c:487 - 8 0x4f9cee3 in wm_handler_fileselect_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2306 - 9 0x4f9e6cc in wm_handler_fileselect_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2404 - 10 0x4fa3306 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2813 - 11 0x4fa35f8 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865 - 12 0x4fa8cff in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288 - 13 0x4f76c4f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 - 14 0x34f7cba in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522 - 15 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/makesrna/intern/rna_ID.c:444 in rna_ID_refine Shadow bytes around the buggy address: 0x0c46801096d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c46801096e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c46801096f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4680109700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c4680109710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa # >0x0c4680109720: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x0c4680109730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4680109740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4680109750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4680109760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c4680109770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): ``` Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ```

Cannot reproduce (no assert, no ASAN crash), please investigate then.

Cannot reproduce (no assert, no ASAN crash), please investigate then.
Member

Is this fixed? I can't reproduce it.

Right click on the linked library

Can you show me where to click exactly?

Is this fixed? I can't reproduce it. > Right click on the linked library Can you show me where to click exactly?
Author

In #83592#1089121, @JacquesLucke wrote:
Is this fixed? I can't reproduce it.

Right click on the linked library

Can you show me where to click exactly?

image.png

> In #83592#1089121, @JacquesLucke wrote: > Is this fixed? I can't reproduce it. > >> Right click on the linked library > > Can you show me where to click exactly? ![image.png](https://archive.blender.org/developer/F9554423/image.png)
Member

Thanks, I can reproduce it with the same ASAN report as @rjg.

Thanks, I can reproduce it with the same ASAN report as @rjg.
Jacques Lucke was assigned by Dalai Felinto 2021-01-28 17:37:01 +01:00

This issue was referenced by dff51d418a

This issue was referenced by dff51d418a6499a9e90adc97ab2bb599de36a860
Member

Changed status from 'Confirmed' to: 'Resolved'

Changed status from 'Confirmed' to: 'Resolved'
Member

Hm, didn't mean to close this task automatically with the commit. Anyway, can someone confirm that dff51d418a fixed this specific bug? It does so for me.

Hm, didn't mean to close this task automatically with the commit. Anyway, can someone confirm that dff51d418a fixed this specific bug? It does so for me.

I can confirm, no crash after dff51d418a.

I can confirm, no crash after dff51d418a.
Thomas Dinges added this to the 2.92 milestone 2023-02-08 16:15:38 +01:00
Sign in to join this conversation.
No Label
Interest
Alembic
Interest
Animation & Rigging
Interest
Asset Browser
Interest
Asset Browser Project Overview
Interest
Audio
Interest
Automated Testing
Interest
Blender Asset Bundle
Interest
BlendFile
Interest
Collada
Interest
Compatibility
Interest
Compositing
Interest
Core
Interest
Cycles
Interest
Dependency Graph
Interest
Development Management
Interest
EEVEE
Interest
EEVEE & Viewport
Interest
Freestyle
Interest
Geometry Nodes
Interest
Grease Pencil
Interest
ID Management
Interest
Images & Movies
Interest
Import Export
Interest
Line Art
Interest
Masking
Interest
Metal
Interest
Modeling
Interest
Modifiers
Interest
Motion Tracking
Interest
Nodes & Physics
Interest
OpenGL
Interest
Overlay
Interest
Overrides
Interest
Performance
Interest
Physics
Interest
Pipeline, Assets & IO
Interest
Platforms, Builds & Tests
Interest
Python API
Interest
Render & Cycles
Interest
Render Pipeline
Interest
Sculpt, Paint & Texture
Interest
Text Editor
Interest
Translations
Interest
Triaging
Interest
Undo
Interest
USD
Interest
User Interface
Interest
UV Editing
Interest
VFX & Video
Interest
Video Sequencer
Interest
Virtual Reality
Interest
Vulkan
Interest
Wayland
Interest
Workbench
Interest: X11
Legacy
Blender 2.8 Project
Legacy
Milestone 1: Basic, Local Asset Browser
Legacy
OpenGL Error
Meta
Good First Issue
Meta
Papercut
Meta
Retrospective
Meta
Security
Module
Animation & Rigging
Module
Core
Module
Development Management
Module
EEVEE & Viewport
Module
Grease Pencil
Module
Modeling
Module
Nodes & Physics
Module
Pipeline, Assets & IO
Module
Platforms, Builds & Tests
Module
Python API
Module
Render & Cycles
Module
Sculpt, Paint & Texture
Module
Triaging
Module
User Interface
Module
VFX & Video
Platform
FreeBSD
Platform
Linux
Platform
macOS
Platform
Windows
Priority
High
Priority
Low
Priority
Normal
Priority
Unbreak Now!
Status
Archived
Status
Confirmed
Status
Duplicate
Status
Needs Info from Developers
Status
Needs Information from User
Status
Needs Triage
Status
Resolved
Type
Bug
Type
Design
Type
Known Issue
Type
Patch
Type
Report
Type
To Do
No Milestone
No project
No Assignees
6 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#83592
No description provided.