2.92 crashes when Duplicating Object inside Collection used for Boolean (set to "Fast" Solver) #86799

New Issue

Ryan Rickett · 2021-03-21T18:59:56+01:00

Ryan Rickett commented

2021-03-21 18:59:56 +01:00

System Information
Operating system: Windows 10 19042.867
Graphics card: 2080 Ti (dual card)

Blender Version
Broken: 2.92.0
Worked: 2.91.1

Short description of error
When I use Boole Modifier and set Operand Type: Collection, I am only able to have one object in the collection, when the Boole Solver is set to "Fast". As soon as I duplicate the object in the collection the program crashes.

Exact steps for others to reproduce the error
I have recreated this in the attached file (simply duplicate the selected object to see what I mean).

blender_crashing.blend

**System Information** Operating system: Windows 10 19042.867 Graphics card: 2080 Ti (dual card) **Blender Version** Broken: 2.92.0 Worked: 2.91.1 **Short description of error** When I use Boole Modifier and set Operand Type: Collection, I am only able to have one object in the collection, when the Boole Solver is set to "Fast". As soon as I duplicate the object in the collection the program crashes. **Exact steps for others to reproduce the error** I have recreated this in the attached file (simply duplicate the selected object to see what I mean). [blender_crashing.blend](https://archive.blender.org/developer/F9902675/blender_crashing.blend)

Ryan Rickett commented

2021-03-21 18:59:56 +01:00

Added subscriber: @glencandle-3

Ryan Rickett changed title from ~~2.92 crashes when Duplicating Object inside Collection used for Boole~~ to 2.92 crashes when Duplicating Object inside Collection used for Boole (set to "Fast" Solver)

2021-03-21 19:35:01 +01:00

Falk David commented

2021-03-22 14:14:23 +01:00

Added subscriber: @filedescriptor

Falk David commented

2021-03-22 14:14:23 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Falk David commented

2021-03-22 14:14:23 +01:00

I can confirm this on the latest 2.93.0 Alpha, branch: master, commit date: 2021-03-22 11:23, hash: c4c195672d.

When using ASAN, this will consistently crash. Here is the report:

==70822==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060025c1518 at pc 0x000005662fe8 bp 0x7fffffffb4a0 sp 0x7fffffffb490
READ of size 8 at 0x6060025c1518 thread T0
    - 0 0x5662fe7 in BM_mesh_bm_from_me /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490
    - 1 0x659f3f8 in BMD_mesh_bm_create /.../blender/source/blender/modifiers/intern/MOD_boolean.c:274
    - 2 0x65b1677 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:835
    - 3 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    - 4 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    - 5 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    - 6 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    - 7 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    - 8 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    - 9 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    - 10 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 11 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    - 12 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    - 13 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    - 14 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    - 15 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 16 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 17 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    - 18 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 19 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    - 20 0x21f83698 in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    - 21 0x21f8335f in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    - 22 0x21f83115 in Task::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    - 23 0x21f84283 in tbb::internal::function_task<Task>::execute() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    - 24 0x51cb3f4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/.../build_linux_debug/bin/blender+0x51cb3f4)
    - 25 0x51cb6aa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/.../build_linux_debug/bin/blender+0x51cb6aa)
    - 26 0x664127b in tbb::task::wait_for_all() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    - 27 0x664320b in tbb::internal::task_group_base::wait() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    - 28 0x21f80c66 in tbb_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:257
    - 29 0x21f821bc in BLI_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:506
    - 30 0x203af4b0 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    - 31 0x202cdabb in deg_flush_updates_and_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    - 32 0x202cdc4f in DEG_evaluate_on_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    - 33 0x3d2f1ff in scene_graph_update_tagged /.../blender/source/blender/blenkernel/intern/scene.c:2642
    - 34 0x3d2f331 in BKE_scene_graph_evaluated_ensure /.../blender/source/blender/blenkernel/intern/scene.c:2686
    - 35 0x906246d in createTransData /.../blender/source/blender/editors/transform/transform_convert.c:1408
    - 36 0x903cc6a in initTransform /.../blender/source/blender/editors/transform/transform.c:1738
    - 37 0x9260e74 in transformops_data /.../blender/source/blender/editors/transform/transform_ops.c:393
    - 38 0x9261a25 in transform_invoke /.../blender/source/blender/editors/transform/transform_ops.c:509
    - 39 0x527e398 in wm_macro_invoke_internal /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:363
    - 40 0x527e85a in wm_macro_invoke /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:388
    - 41 0x51f5909 in wm_operator_invoke /.../blender/source/blender/windowmanager/intern/wm_event_system.c:1350
    - 42 0x51fdffd in wm_handler_operator_call /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2178
    - 43 0x5201b23 in wm_handlers_do_keymap_with_keymap_handler /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2503
    - 44 0x52052d7 in wm_handlers_do_intern /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2799
    - 45 0x52067f3 in wm_handlers_do /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2931
    - 46 0x520c40e in wm_event_do_handlers /.../blender/source/blender/windowmanager/intern/wm_event_system.c:3421
    - 47 0x51d70c3 in WM_main /.../blender/source/blender/windowmanager/intern/wm.c:646
    - 48 0x364c819 in main /.../blender/source/creator/creator.c:520
    - 49 0x7ffff6e48cb1 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1)
    #50 0x364b9cd in _start (/.../build_linux_debug/bin/blender+0x364b9cd)

0x6060025c1518 is located 0 bytes to the right of 56-byte region [0x6060025c14e0,0x6060025c1518)
freed by thread T0 here:
    - 0 0x7ffff76801b7 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xb01b7)
    - 1 0x21fc19ca in MEM_lockfree_freeN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    - 2 0x21b1635c in BLI_mempool_destroy /.../blender/source/blender/blenlib/intern/BLI_mempool.c:765
    - 3 0x21acca98 in BLI_ghash_free /.../blender/source/blender/blenlib/intern/BLI_ghash.c:1016
    - 4 0xa74cfd9 in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:1657
    - 5 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428
    - 6 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837
    - 7 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    - 8 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    - 9 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    - 10 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    - 11 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    - 12 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    - 13 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    - 14 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 15 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    - 16 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    - 17 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    - 18 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    - 19 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 20 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 21 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    - 22 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 23 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    #24 0x7fffffffcb1f  ([stack]+0x1fb1f)

previously allocated by thread T0 here:
    - 0 0x7ffff7680517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517)
    - 1 0x21fc2424 in MEM_lockfree_mallocN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    - 2 0x21b11f57 in BLI_mempool_create /.../blender/source/blender/blenlib/intern/BLI_mempool.c:275
    - 3 0x21ac5891 in ghash_new /.../blender/source/blender/blenlib/intern/BLI_ghash.c:447
    - 4 0x21ac7bc0 in BLI_ghash_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash.c:712
    - 5 0x21ad2aad in BLI_ghash_ptr_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:215
    - 6 0x21ad2ad0 in BLI_ghash_ptr_new /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:219
    - 7 0xa741aaf in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:994
    - 8 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428
    - 9 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837
    - 10 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    - 11 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    - 12 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    - 13 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    - 14 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    - 15 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    - 16 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    - 17 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    - 18 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    - 19 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    - 20 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    - 21 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    - 22 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 23 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 24 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    - 25 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    - 26 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    - 27 0x7fffffffcb1f  ([stack]+0x1fb1f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490 in BM_mesh_bm_from_me
Shadow bytes around the buggy address:
  0x0c0c804b0250: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b0260: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c804b0270: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c804b0280: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b0290: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
=>0x0c0c804b02a0: fd fd fd[fa]fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c804b02b0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b02c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c804b02d0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c804b02e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b02f0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==70822==ABORTING

I can confirm this on the latest 2.93.0 Alpha, branch: master, commit date: 2021-03-22 11:23, hash: `c4c195672d`. When using ASAN, this will consistently crash. Here is the report: ``` ==70822==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060025c1518 at pc 0x000005662fe8 bp 0x7fffffffb4a0 sp 0x7fffffffb490 READ of size 8 at 0x6060025c1518 thread T0 - 0 0x5662fe7 in BM_mesh_bm_from_me /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490 - 1 0x659f3f8 in BMD_mesh_bm_create /.../blender/source/blender/modifiers/intern/MOD_boolean.c:274 - 2 0x65b1677 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:835 - 3 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055 - 4 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930 - 5 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304 - 6 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922 - 7 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070 - 8 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195 - 9 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381 - 10 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 11 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60 - 12 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110 - 13 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291 - 14 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622 - 15 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 16 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 17 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118 - 18 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 19 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594) - 20 0x21f83698 in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216 - 21 0x21f8335f in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472 - 22 0x21f83115 in Task::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118 - 23 0x21f84283 in tbb::internal::function_task<Task>::execute() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 - 24 0x51cb3f4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/.../build_linux_debug/bin/blender+0x51cb3f4) - 25 0x51cb6aa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/.../build_linux_debug/bin/blender+0x51cb6aa) - 26 0x664127b in tbb::task::wait_for_all() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820 - 27 0x664320b in tbb::internal::task_group_base::wait() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168 - 28 0x21f80c66 in tbb_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:257 - 29 0x21f821bc in BLI_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:506 - 30 0x203af4b0 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397 - 31 0x202cdabb in deg_flush_updates_and_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58 - 32 0x202cdc4f in DEG_evaluate_on_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 - 33 0x3d2f1ff in scene_graph_update_tagged /.../blender/source/blender/blenkernel/intern/scene.c:2642 - 34 0x3d2f331 in BKE_scene_graph_evaluated_ensure /.../blender/source/blender/blenkernel/intern/scene.c:2686 - 35 0x906246d in createTransData /.../blender/source/blender/editors/transform/transform_convert.c:1408 - 36 0x903cc6a in initTransform /.../blender/source/blender/editors/transform/transform.c:1738 - 37 0x9260e74 in transformops_data /.../blender/source/blender/editors/transform/transform_ops.c:393 - 38 0x9261a25 in transform_invoke /.../blender/source/blender/editors/transform/transform_ops.c:509 - 39 0x527e398 in wm_macro_invoke_internal /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:363 - 40 0x527e85a in wm_macro_invoke /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:388 - 41 0x51f5909 in wm_operator_invoke /.../blender/source/blender/windowmanager/intern/wm_event_system.c:1350 - 42 0x51fdffd in wm_handler_operator_call /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2178 - 43 0x5201b23 in wm_handlers_do_keymap_with_keymap_handler /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2503 - 44 0x52052d7 in wm_handlers_do_intern /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2799 - 45 0x52067f3 in wm_handlers_do /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2931 - 46 0x520c40e in wm_event_do_handlers /.../blender/source/blender/windowmanager/intern/wm_event_system.c:3421 - 47 0x51d70c3 in WM_main /.../blender/source/blender/windowmanager/intern/wm.c:646 - 48 0x364c819 in main /.../blender/source/creator/creator.c:520 - 49 0x7ffff6e48cb1 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1) #50 0x364b9cd in _start (/.../build_linux_debug/bin/blender+0x364b9cd) 0x6060025c1518 is located 0 bytes to the right of 56-byte region [0x6060025c14e0,0x6060025c1518) freed by thread T0 here: - 0 0x7ffff76801b7 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xb01b7) - 1 0x21fc19ca in MEM_lockfree_freeN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129 - 2 0x21b1635c in BLI_mempool_destroy /.../blender/source/blender/blenlib/intern/BLI_mempool.c:765 - 3 0x21acca98 in BLI_ghash_free /.../blender/source/blender/blenlib/intern/BLI_ghash.c:1016 - 4 0xa74cfd9 in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:1657 - 5 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428 - 6 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837 - 7 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055 - 8 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930 - 9 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304 - 10 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922 - 11 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070 - 12 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195 - 13 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381 - 14 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 15 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60 - 16 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110 - 17 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291 - 18 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622 - 19 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 20 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 21 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118 - 22 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 23 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594) #24 0x7fffffffcb1f ([stack]+0x1fb1f) previously allocated by thread T0 here: - 0 0x7ffff7680517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517) - 1 0x21fc2424 in MEM_lockfree_mallocN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276 - 2 0x21b11f57 in BLI_mempool_create /.../blender/source/blender/blenlib/intern/BLI_mempool.c:275 - 3 0x21ac5891 in ghash_new /.../blender/source/blender/blenlib/intern/BLI_ghash.c:447 - 4 0x21ac7bc0 in BLI_ghash_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash.c:712 - 5 0x21ad2aad in BLI_ghash_ptr_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:215 - 6 0x21ad2ad0 in BLI_ghash_ptr_new /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:219 - 7 0xa741aaf in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:994 - 8 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428 - 9 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837 - 10 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055 - 11 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930 - 12 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304 - 13 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922 - 14 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070 - 15 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195 - 16 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381 - 17 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351 - 18 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60 - 19 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110 - 20 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291 - 21 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622 - 22 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 23 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 24 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118 - 25 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 - 26 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594) - 27 0x7fffffffcb1f ([stack]+0x1fb1f) SUMMARY: AddressSanitizer: heap-buffer-overflow /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490 in BM_mesh_bm_from_me Shadow bytes around the buggy address: 0x0c0c804b0250: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0c804b0260: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x0c0c804b0270: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c0c804b0280: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0c804b0290: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd =>0x0c0c804b02a0: fd fd fd[fa]fa fa fa fa fd fd fd fd fd fd fd fa 0x0c0c804b02b0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0c804b02c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd 0x0c0c804b02d0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa 0x0c0c804b02e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa 0x0c0c804b02f0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==70822==ABORTING ```

Philipp Oeser commented

2021-03-22 16:34:04 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2021-03-22 16:34:04 +01:00

Think this deserves to be High priority.

Philipp Oeser changed title from ~~2.92 crashes when Duplicating Object inside Collection used for Boole (set to "Fast" Solver)~~ to 2.92 crashes when Duplicating Object inside Collection used for Boolean (set to "Fast" Solver)

2021-03-22 16:34:19 +01:00

Lukas Tönne commented

2021-04-02 16:46:26 +02:00

Added subscriber: @LukasTonne

Lukas Tönne commented

2021-04-02 16:46:26 +02:00

This crashes because BM_mesh_bm_from_me expects the input Mesh data block to have valid selection indices. If that's not the case then the face table it uses causes out-of-bounds crash.
The outcome of the first collection step is already incorrect (MSelect contains invalid index), but the inverse BM_mesh_bm_to_me function does not care. It's only in the 2nd collection step when the Mesh block is reused that things fall apart.
What causes the incorrect indices is that BM_mesh_intersect reduces the number of faces (from 224 of the operand mesh to 6 of the intersection), but does not correct selection indices of the BMesh to match.

I'm unsure about expected behavior regarding selection:

If invalid selection indices are allowed in BMesh and Mesh data blocks then BM_mesh_bm_from_me should check before accessing the face table: https://developer.blender.org/diffusion/B/browse/master/source/blender/bmesh/intern/bmesh_mesh_convert.c$484
If invalid selection indices are not allowed in BMesh then BM_mesh_intersect should additionally correct selection indices
If invalid selection indices are allowed in BMesh but not Mesh then BM_mesh_bm_to_me should correct selection indices

This crashes because `BM_mesh_bm_from_me` expects the input `Mesh` data block to have valid selection indices. If that's not the case then the face table it uses causes out-of-bounds crash. The outcome of the first collection step is already incorrect (`MSelect` contains invalid index), but the inverse `BM_mesh_bm_to_me` function does not care. It's only in the 2nd collection step when the `Mesh` block is reused that things fall apart. What causes the incorrect indices is that `BM_mesh_intersect` reduces the number of faces (from 224 of the operand mesh to 6 of the intersection), but does not correct selection indices of the BMesh to match. I'm unsure about expected behavior regarding selection: 1. If invalid selection indices are allowed in BMesh and Mesh data blocks then `BM_mesh_bm_from_me` should check before accessing the face table: https://developer.blender.org/diffusion/B/browse/master/source/blender/bmesh/intern/bmesh_mesh_convert.c$484 1. If invalid selection indices are not allowed in BMesh then BM_mesh_intersect should additionally correct selection indices 1. If invalid selection indices are allowed in BMesh but not Mesh then BM_mesh_bm_to_me should correct selection indices

blender-admin commented

2021-04-29 16:51:14 +02:00

This issue was referenced by 315582f28c

This issue was referenced by 315582f28cefbf158b308f0dea17dab949eb6eff

Campbell Barton commented

2021-04-29 16:59:53 +02:00

Changed status from 'Confirmed' to: 'Resolved'

Campbell Barton closed this issue

2021-04-29 16:59:53 +02:00

Campbell Barton self-assigned this 2021-04-29 16:59:53 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

2.92 crashes when Duplicating Object inside Collection used for Boolean (set to "Fast" Solver) #86799