Ctrl clicking 3 times without selecting any of the verts in NurbsPath leads crash. #86073

New Issue

NXSK · 2021-02-28T06:45:53+01:00

NXSK commented

2021-02-28 06:45:53 +01:00

System Information
Not relevant, occurs on Linux and Windows and regardless of GPU hardware.

Blender Version
Broken:

2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: b1ef55abdb
2.92.0 stable
2.91.2, branch: master, commit date: 2021-01-19 16:15, hash: 5be9ef4177
Worked:
Unknown

As the topic described, I tested bezier curve and it works fine.

Exact steps for others to reproduce the error

Add > Curve > Path.
Switch to edit mode and deselect everything ({key Alt A}).

Use {key Ctrl RMB} and press into the void of the 3D view for at least three times.

Blender should either crash or produce visual artifacts where parts of the curve appear to extend to infinity.

ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: b1ef55abdb

## 3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720
READ of size 4 at 0x6020002e3a78 thread T0
    - 0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62
    - 1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755
    - 2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513
    - 3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    - 4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    - 5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    - 6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    - 14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    - 15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    - 16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    - 18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284)
    - 19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a)
    - 20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    - 21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    - 22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257
    - 23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506
    - 24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    - 25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    - 26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    - 27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641
    - 28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680
    - 29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387
    - 30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412
    - 31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614
    - 32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646
    - 33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520
    - 34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    - 35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d)

0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78)
allocated by thread T0 here:
    - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    - 1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    - 2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312
    - 3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689
    - 4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743
    - 5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505
    - 6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    - 7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    - 8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    - 9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    - 17 0x7fffffffd1df  ([stack]+0x201df)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3
Shadow bytes around the buggy address:
  0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
# >0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa]
  0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc

**System Information** Not relevant, occurs on Linux and Windows and regardless of GPU hardware. **Blender Version** Broken: - 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: `b1ef55abdb` - 2.92.0 stable - 2.91.2, branch: master, commit date: 2021-01-19 16:15, hash: `5be9ef4177` Worked: - Unknown As the topic described, I tested bezier curve and it works fine. **Exact steps for others to reproduce the error** - *Add > Curve > Path*. - Switch to edit mode and deselect everything ({key Alt A}). # Use {key Ctrl RMB} and press into the void of the 3D view for at least three times. Blender should either crash or produce visual artifacts where parts of the curve appear to extend to infinity. ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: `b1ef55abdb` ```lines ## 3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720 READ of size 4 at 0x6020002e3a78 thread T0 - 0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 - 1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755 - 2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513 - 3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743 - 4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218 - 5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379 - 6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424) - 14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216 - 15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472 - 16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 - 18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284) - 19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a) - 20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820 - 21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168 - 22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257 - 23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506 - 24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397 - 25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58 - 26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 - 27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641 - 28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680 - 29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387 - 30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412 - 31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614 - 32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646 - 33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520 - 34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) - 35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d) 0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78) allocated by thread T0 here: - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) - 1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276 - 2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312 - 3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689 - 4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743 - 5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505 - 6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743 - 7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218 - 8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379 - 9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424) - 17 0x7fffffffd1df ([stack]+0x201df) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3 Shadow bytes around the buggy address: 0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa # >0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa] 0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd 0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): ``` Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ```

NXSK commented

2021-02-28 06:45:53 +01:00

Added subscriber: @NXSK

Robert Guetzkow commented

2021-02-28 12:33:02 +01:00

Added subscriber: @rjg

Robert Guetzkow commented

2021-02-28 12:33:02 +01:00

Changed status from 'Needs Triage' to: 'Needs User Info'

Robert Guetzkow commented

2021-02-28 12:33:02 +01:00

I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: 02948a2cab or current master branch. Is there any particular step that might be missing in your instructions?

Please open Blender's installation directory and double click on the blender_debug_gpu.cmd. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt (or simply type %TEMP% into the path bar of the Windows Explorer).

I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: `02948a2cab` or current master branch. Is there any particular step that might be missing in your instructions? Please open Blender's installation directory and double click on the `blender_debug_gpu.cmd`. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in `C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt` (or simply type `%TEMP%` into the path bar of the Windows Explorer). ![2019_12_04_upload_icon_developer_blender_org.png](https://archive.blender.org/developer/F8190038/2019_12_04_upload_icon_developer_blender_org.png)

NXSK commented

2021-03-01 10:12:22 +01:00

In #86073#1120478, @rjg wrote:
I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: 02948a2cab or current master branch. Is there any particular step that might be missing in your instructions?

Please open Blender's installation directory and double click on the blender_debug_gpu.cmd. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt (or simply type %TEMP% into the path bar of the Windows Explorer).

Thank you. I collectted the files you mentioned. And I tested with another of my pc and got the same result.blender_system_info.txt

blender_debug_output.txt

blender.crash.txt

> In #86073#1120478, @rjg wrote: > I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: `02948a2cab` or current master branch. Is there any particular step that might be missing in your instructions? > > Please open Blender's installation directory and double click on the `blender_debug_gpu.cmd`. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in `C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt` (or simply type `%TEMP%` into the path bar of the Windows Explorer). > > ![2019_12_04_upload_icon_developer_blender_org.png](https://archive.blender.org/developer/F8190038/2019_12_04_upload_icon_developer_blender_org.png) Thank you. I collectted the files you mentioned. And I tested with another of my pc and got the same result.[blender_system_info.txt](https://archive.blender.org/developer/F9855809/blender_system_info.txt) [blender_debug_output.txt](https://archive.blender.org/developer/F9855807/blender_debug_output.txt) [blender.crash.txt](https://archive.blender.org/developer/F9855806/blender.crash.txt)

Robert Guetzkow commented

2021-03-08 19:13:54 +01:00

@NXSK based on the stack trace this appears to crash in graphics driver (nvoglv64.dll). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening?

@NXSK based on the stack trace this appears to crash in graphics driver (`nvoglv64.dll`). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening?

NXSK commented

2021-03-17 10:51:52 +01:00

In #86073#1126375, @rjg wrote:
@NXSK based on the stack trace this appears to crash in graphics driver (nvoglv64.dll). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening?

I tested with 3 recent versions of graphics driver (460.40 460.72 460.92) and all of them have the same issue.

> In #86073#1126375, @rjg wrote: > @NXSK based on the stack trace this appears to crash in graphics driver (`nvoglv64.dll`). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening? I tested with 3 recent versions of graphics driver (460.40 460.72 460.92) and all of them have the same issue.

Robert Guetzkow commented

2021-03-17 12:26:42 +01:00

@NXSK Is there anything missing from the description that is necessary to trigger the crash?

NXSK commented

2021-03-18 15:17:58 +01:00

@rjg I asked some friends and they said they don't have the same issue. But 2 of my PCs both have. One amd and another intel.

So I shut off all the plugins and tested. It still happens. Is there any possibilities that blender is not compatible with other softwares?

@rjg I asked some friends and they said they don't have the same issue. But 2 of my PCs both have. One amd and another intel. So I shut off all the plugins and tested. It still happens. Is there any possibilities that blender is not compatible with other softwares?

Robert Guetzkow commented

2021-03-18 17:53:35 +01:00

@NXSK Could you please add the crash log from the AMD one?

NXSK commented

2021-03-19 09:28:59 +01:00

blender_debug_output.txt

blender_system_info.txt

blender_debug_output 2.txt

blender_system_info 2.txt

@rjg I tested 2 times. The first time blender crashed. The second time it didn't crash but when I was clicking around the blank space, blender was not responding and the operation didn't create new NURBS points but the effect like the picture below.

[blender_debug_output.txt](https://archive.blender.org/developer/F9899217/blender_debug_output.txt) [blender_system_info.txt](https://archive.blender.org/developer/F9899218/blender_system_info.txt) [blender_debug_output 2.txt](https://archive.blender.org/developer/F9899219/blender_debug_output_2.txt) [blender_system_info 2.txt](https://archive.blender.org/developer/F9899221/blender_system_info_2.txt) @rjg I tested 2 times. The first time blender crashed. The second time it didn't crash but when I was clicking around the blank space, blender was not responding and the operation didn't create new NURBS points but the effect like the picture below. ![20210319162120.jpg](https://archive.blender.org/developer/F9899223/20210319162120.jpg) ![20210319162156.jpg](https://archive.blender.org/developer/F9899225/20210319162156.jpg)

Robert Guetzkow commented

2021-03-19 09:37:53 +01:00

Changed status from 'Needs User Info' to: 'Needs Triage'

Robert Guetzkow commented

2021-03-19 09:37:53 +01:00

Interesting parts from the log files. This needs further investigation.

Memoryblock GPUIndexBuf data: end corrupt
Memoryblock GPUIndexBuf data: end corrupt
Memoryblock (null): Additional error in header
Memoryblock Additional error in header: is also corrupt
Memoryblock free: pointer not in memlist

Interesting parts from the log files. This needs further investigation. ```lines Memoryblock GPUIndexBuf data: end corrupt Memoryblock GPUIndexBuf data: end corrupt Memoryblock (null): Additional error in header Memoryblock Additional error in header: is also corrupt Memoryblock free: pointer not in memlist ```

Pratik Borhade commented

2021-03-19 15:43:38 +01:00

Added subscriber: @PratikPB2123

Pratik Borhade commented

2021-03-19 15:43:38 +01:00

@rjg , ctrl + R_click (3x) crashes the blender .

@rjg , `ctrl + R_click` (3x) crashes the blender .

Robert Guetzkow commented

2021-03-19 16:21:10 +01:00

@PratikPB2123 You're right, I must have only tested with left click. @NXSK sorry about that.

ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: b1ef55abdb

## 3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720
READ of size 4 at 0x6020002e3a78 thread T0
    - 0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62
    - 1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755
    - 2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513
    - 3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    - 4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    - 5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    - 6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    - 14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    - 15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    - 16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    - 18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284)
    - 19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a)
    - 20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    - 21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    - 22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257
    - 23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506
    - 24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    - 25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    - 26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    - 27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641
    - 28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680
    - 29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387
    - 30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412
    - 31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614
    - 32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646
    - 33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520
    - 34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    - 35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d)

0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78)
allocated by thread T0 here:
    - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    - 1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    - 2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312
    - 3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689
    - 4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743
    - 5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505
    - 6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    - 7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    - 8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    - 9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    - 17 0x7fffffffd1df  ([stack]+0x201df)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3
Shadow bytes around the buggy address:
  0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
# >0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa]
  0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc

I'm not getting crashes in the release builds of 2.91 and 2.90.1 but both show visual artifacts, which seems to indicate that the same issue might have already been in those version. This would have to be verified though.

@PratikPB2123 You're right, I must have only tested with left click. @NXSK sorry about that. ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: `b1ef55abdb` ```lines ## 3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720 READ of size 4 at 0x6020002e3a78 thread T0 - 0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 - 1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755 - 2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513 - 3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743 - 4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218 - 5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379 - 6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424) - 14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216 - 15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472 - 16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 - 18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284) - 19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a) - 20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820 - 21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168 - 22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257 - 23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506 - 24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397 - 25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58 - 26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 - 27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641 - 28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680 - 29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387 - 30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412 - 31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614 - 32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646 - 33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520 - 34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) - 35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d) 0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78) allocated by thread T0 here: - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) - 1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276 - 2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312 - 3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689 - 4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743 - 5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505 - 6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743 - 7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218 - 8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379 - 9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424) - 17 0x7fffffffd1df ([stack]+0x201df) SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3 Shadow bytes around the buggy address: 0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa # >0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa] 0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd 0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd 0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd Shadow byte legend (one shadow byte represents 8 application bytes): ``` Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ``` ``` I'm not getting crashes in the release builds of 2.91 and 2.90.1 but both show visual artifacts, which seems to indicate that the same issue might have already been in those version. This would have to be verified though.

Robert Guetzkow commented

2021-03-19 16:30:50 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Pratik Borhade self-assigned this 2021-03-21 04:35:11 +01:00

Pratik Borhade commented

2021-03-21 04:35:11 +01:00

will check to resolve the crash .