Page MenuHome

Segfault on unregistering operator/menu with open props dialog.
Confirmed, NormalPublic

Description

System Information
Operating system: Linux
Graphics card: Intel

Blender Version
Broken: 2.92, 2.93

Short description of error

When an operator currently has a wm.props_dialog_(self) open, unregistering it will cause a segfault.

This only seems to happen reliably when the module it's from has at least one bpy.types.Menu subclass that's also been registered.

The displayed values of property fields in the dialog will sometimes flicker and switch values with each other for a split second before the segfault.

Exact steps for others to reproduce the error

  1. Open the attached file.
  1. Invoke the operator from the 3DView toolbar.
  1. Use a system hotkey (E.G. ALT+TAB) to switch to the window with the text editor space while leaving the props dialog open.
  1. Run the script again from the text editor window.

Event Timeline

Will (WCN) updated the task description. (Show Details)Jun 13 2021, 11:07 PM

Here's a somewhat shorter reproducer that triggers invokes the operator and triggers the crash automatically:

As with before, I could only get it to happen reliably when there's also a menu class that gets (un) regsitered.

"""Press the Run Script button for a segfault."""

import bpy


class InvokeOperator(bpy.types.Operator):
	"""Tooltip"""
	bl_idname = "object.invoke_segfault"
	bl_label = "Invoke"
	bl_options = {'REGISTER', 'UNDO'}

	prop: bpy.props.EnumProperty(name="prop", items=[(c,)*3 for c in "ABC"], default="A")
	prop2: bpy.props.StringProperty(name="prop2", default="value")
	
	def invoke(self, context, event):
		context.window_manager.invoke_props_dialog(self)
		return {'RUNNING_MODAL'}

	def execute(self, context):
		return {'FINISHED'}


class SomeMenu(bpy.types.Menu):
	bl_idname = "TEST_MT_menu"
	bl_label = "InvokeMenu"

	def draw(self, context):
		pass


def register():
	bpy.utils.register_class(InvokeOperator)
	bpy.utils.register_class(SomeMenu)

def unregister():
	bpy.utils.unregister_class(InvokeOperator)
	bpy.utils.unregister_class(SomeMenu)


if __name__ == "__main__":
	register()
	bpy.ops.object.invoke_segfault('INVOKE_DEFAULT')
	unregister()

Can recreate the crash with version 3.0.0 (rB7af40ccf5f2)

	blender.exe!RNA_property_subtype(PropertyRNA * prop) Line 1184
 	blender.exe!ui_but_text_password_hide(unsigned char * password_str, uiBut * but, const bool restore) Line 2830
 	blender.exe!widget_draw_text_icon(const uiFontStyle * fstyle, const uiWidgetColors * wcol, uiBut * but, rcti * rect) Line 2360
 	blender.exe!ui_draw_but(const bContext * C, ARegion * region, uiStyle * style, uiBut * but, rcti * rect) Line 4944
 	blender.exe!UI_block_draw(const bContext * C, uiBlock * block) Line 2054
 	blender.exe!ui_block_region_draw(const bContext * C, ARegion * region) Line 410
 	blender.exe!ED_region_do_draw(bContext * C, ARegion * region) Line 563
 	blender.exe!wm_draw_window_offscreen(bContext * C, wmWindow * win, bool stereo) Line 758
 	blender.exe!wm_draw_window(bContext * C, wmWindow * win) Line 867
 	blender.exe!wm_draw_update(bContext * C) Line 1066
 	blender.exe!WM_main(bContext * C) Line 654
 	blender.exe!main(int argc, const unsigned char * * UNUSED_argv_c) Line 562
Pratik Borhade (PratikPB2123) changed the task status from Needs Triage to Confirmed.Wed, Jul 7, 12:33 PM