Page MenuHome
Create Task
Maniphest T86073

Ctrl clicking 3 times without selecting any of the verts in NurbsPath leads crash.
Closed, ResolvedPublic
Actions

Description

System Information
Not relevant, occurs on Linux and Windows and regardless of GPU hardware.

Blender Version
Broken:

  • 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: rBb1ef55abdbb9
  • 2.92.0 stable
  • 2.91.2, branch: master, commit date: 2021-01-19 16:15, hash: rB5be9ef417703

Worked:

  • Unknown

As the topic described, I tested bezier curve and it works fine.

Exact steps for others to reproduce the error

  1. Add > Curve > Path.
  2. Switch to edit mode and deselect everything (Alt+A).
  3. Use Ctrl+RMB and press into the void of the 3D view for at least three times.

Blender should either crash or produce visual artifacts where parts of the curve appear to extend to infinity.

ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: rBb1ef55abdbb9

==3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720
READ of size 4 at 0x6020002e3a78 thread T0
    #0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62
    #1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755
    #2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513
    #3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    #4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    #5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    #6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    #8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    #9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    #14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    #15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    #16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    #18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284)
    #19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a)
    #20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    #21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    #22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257
    #23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506
    #24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    #25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    #26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    #27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641
    #28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680
    #29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387
    #30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412
    #31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614
    #32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646
    #33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520
    #34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d)

0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78)
allocated by thread T0 here:
    #0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    #2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312
    #3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689
    #4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743
    #5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505
    #6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    #7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    #8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    #9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    #11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    #12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    #17 0x7fffffffd1df  ([stack]+0x201df)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3
Shadow bytes around the buggy address:
  0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa]
  0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

Revisions and Commits

rB Blender
AbandonedD10785 Fix T86073 : Ctrl clicking 3 times without selecting any of the verts in NurbsPath leads crash.
rB9e206039d4f6 Fix T86073 : Ctrl clicking 3 times without selecting any of the verts in…

Event Timeline

NXSK (NXSK) created this task.Feb 28 2021, 6:45 AM
NXSK (NXSK) updated the task description. (Show Details)
Robert Guetzkow (rjg) changed the task status from Needs Triage to Needs Information from User.Feb 28 2021, 12:33 PM
Robert Guetzkow (rjg) added a subscriber: Robert Guetzkow (rjg).

I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: rB02948a2cab44 or current master branch. Is there any particular step that might be missing in your instructions?

Please open Blender's installation directory and double click on the blender_debug_gpu.cmd. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt (or simply type %TEMP% into the path bar of the Windows Explorer).

NXSK (NXSK) added a comment.Mar 1 2021, 10:12 AM
In T86073#1120478, @Robert Guetzkow (rjg) wrote:

I'm unable to reproduce this with Blender 2.92.0, branch: master, commit date: 2021-02-24 16:25, hash: rB02948a2cab44 or current master branch. Is there any particular step that might be missing in your instructions?

Please open Blender's installation directory and double click on the blender_debug_gpu.cmd. This will start Blender in debug mode and create log files. Try to make Blender crash again. Once it crashes the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button as shown in the screenshot below or via drag and drop. Please also upload the crash log located in C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt (or simply type %TEMP% into the path bar of the Windows Explorer).

Thank you. I collectted the files you mentioned. And I tested with another of my pc and got the same result.

blender_system_info.txt30 KBDownload

blender_debug_output.txt785 BDownload

blender.crash.txt17 KBDownload

Robert Guetzkow (rjg) added a comment.Mar 8 2021, 7:13 PM

@NXSK (NXSK) based on the stack trace this appears to crash in graphics driver (nvoglv64.dll). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening?

NXSK (NXSK) added a comment.Mar 17 2021, 10:51 AM
In T86073#1126375, @Robert Guetzkow (rjg) wrote:

@NXSK (NXSK) based on the stack trace this appears to crash in graphics driver (nvoglv64.dll). Could you please check if either installing a newer driver version or previous driver version prevents the crash from happening?

I tested with 3 recent versions of graphics driver (460.40 460.72 460.92) and all of them have the same issue.

Robert Guetzkow (rjg) added a comment.EditedMar 17 2021, 12:26 PM

@NXSK (NXSK) Is there anything missing from the description that is necessary to trigger the crash?

NXSK (NXSK) added a comment.Mar 18 2021, 3:17 PM

@Robert Guetzkow (rjg) I asked some friends and they said they don't have the same issue. But 2 of my PCs both have. One amd and another intel.

So I shut off all the plugins and tested. It still happens. Is there any possibilities that blender is not compatible with other softwares?

Robert Guetzkow (rjg) added a comment.Mar 18 2021, 5:53 PM

@NXSK (NXSK) Could you please add the crash log from the AMD one?

NXSK (NXSK) added a comment.Mar 19 2021, 9:28 AM

blender_debug_output.txt785 BDownload

blender_system_info.txt31 KBDownload

blender_debug_output 2.txt1 KBDownload

blender_system_info 2.txt31 KBDownload

@Robert Guetzkow (rjg) I tested 2 times. The first time blender crashed. The second time it didn't crash but when I was clicking around the blank space, blender was not responding and the operation didn't create new NURBS points but the effect like the picture below.

Robert Guetzkow (rjg) changed the task status from Needs Information from User to Needs Triage.Mar 19 2021, 9:37 AM

Interesting parts from the log files. This needs further investigation.

Memoryblock GPUIndexBuf data: end corrupt
Memoryblock GPUIndexBuf data: end corrupt
Memoryblock (null): Additional error in header
Memoryblock Additional error in header: is also corrupt
Memoryblock free: pointer not in memlist
Pratik Borhade (PratikPB2123) added a subscriber: Pratik Borhade (PratikPB2123).Mar 19 2021, 3:43 PM

@Robert Guetzkow (rjg) , ctrl + R_click (3x) crashes the blender .

Robert Guetzkow (rjg) added a comment.EditedMar 19 2021, 4:21 PM

@Pratik Borhade (PratikPB2123) You're right, I must have only tested with left click. @NXSK (NXSK) sorry about that.

ASAN report for 2.93.0 Alpha, branch: master, commit date: 2021-03-09 16:42, hash: rBb1ef55abdbb9

==3501==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020002e3a78 at pc 0x00000365f400 bp 0x7fffffffc730 sp 0x7fffffffc720
READ of size 4 at 0x6020002e3a78 thread T0
    #0 0x365f3ff in copy_v3_v3 /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62
    #1 0x368d13b in BKE_curve_bevelList_make /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:2755
    #2 0x4e12069 in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1513
    #3 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    #4 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    #5 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    #6 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #7 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    #8 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    #9 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #10 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #11 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #12 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #13 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    #14 0x1a87096a in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    #15 0x1a870614 in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    #16 0x1a87036b in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #17 0x1a8715ad in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    #18 0x5135284 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5135284)
    #19 0x513553a in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x513553a)
    #20 0x65b4f31 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    #21 0x65b6f2e in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    #22 0x1a86de69 in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:257
    #23 0x1a86f3c7 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:506
    #24 0x18c91d91 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    #25 0x18bae94e in deg_flush_updates_and_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    #26 0x18baeade in DEG_evaluate_on_refresh /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    #27 0x3cb394c in scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2641
    #28 0x3cb3a50 in BKE_scene_graph_update_tagged /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/scene.c:2680
    #29 0x51557ca in wm_event_do_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387
    #30 0x5155b38 in wm_event_do_refresh_wm_and_depsgraph /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412
    #31 0x5158068 in wm_event_do_notifiers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:614
    #32 0x5140f08 in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:646
    #33 0x35d7c9a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:520
    #34 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #35 0x35d6e4d in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x35d6e4d)

0x6020002e3a78 is located 0 bytes to the right of 8-byte region [0x6020002e3a70,0x6020002e3a78)
allocated by thread T0 here:
    #0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x1a8afe20 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    #2 0x1a8b01c7 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312
    #3 0x366e743 in BKE_nurb_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:689
    #4 0x366f779 in BKE_nurbList_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/curve.c:743
    #5 0x4e11ffc in do_makeDispListCurveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1505
    #6 0x4e165a0 in BKE_displist_make_curveTypes /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/displist.c:1743
    #7 0x3ab9dd0 in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:218
    #8 0x3abc6db in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:379
    #9 0x18cfedd8 in operator() /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #10 0x18d21c2b in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    #11 0x18c93eea in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    #12 0x18c8f459 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #13 0x18c8f4a8 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #14 0x1a87029a in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    #15 0x1a87170d in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #16 0x5124424 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x5124424)
    #17 0x7fffffffd1df  ([stack]+0x201df)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/math_vector_inline.c:62 in copy_v3_v3
Shadow bytes around the buggy address:
  0x0c04800546f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c0480054730: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c0480054740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa 00[fa]
  0x0c0480054750: fa fa 00 fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054760: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054770: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
  0x0c0480054780: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
  0x0c0480054790: fa fa fd fd fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

I'm not getting crashes in the release builds of 2.91 and 2.90.1 but both show visual artifacts, which seems to indicate that the same issue might have already been in those version. This would have to be verified though.

Robert Guetzkow (rjg) updated the task description. (Show Details)Mar 19 2021, 4:27 PM
Robert Guetzkow (rjg) updated the task description. (Show Details)
Robert Guetzkow (rjg) changed the task status from Needs Triage to Confirmed.Mar 19 2021, 4:29 PM
Robert Guetzkow (rjg) updated the task description. (Show Details)
Robert Guetzkow (rjg) updated the task description. (Show Details)
Robert Guetzkow (rjg) added a project: Modeling.
Robert Guetzkow (rjg) updated the task description. (Show Details)
Robert Guetzkow (rjg) updated the task description. (Show Details)
Pratik Borhade (PratikPB2123) claimed this task.Mar 21 2021, 4:35 AM

will check to resolve the crash .

Pratik Borhade (PratikPB2123) added a revision: D10785: Fix T86073 : Ctrl clicking 3 times without selecting any of the verts in NurbsPath leads crash..Mar 22 2021, 11:05 AM
Germano Cavalcante (mano-wii) closed this task as Resolved by committing rB9e206039d4f6: Fix T86073 : Ctrl clicking 3 times without selecting any of the verts in….Mar 23 2021, 3:56 PM
Germano Cavalcante (mano-wii) added a commit: rB9e206039d4f6: Fix T86073 : Ctrl clicking 3 times without selecting any of the verts in….