Crashing during animation with Geometry Nodes ( when clicked on Attribute Randomize - Attribute field ) #89313

Closed
opened 2021-06-20 16:15:38 +02:00 by Petr Smrtka · 25 comments

Blender Version
Broken: version: 2.93, 3.0.0 Alpha, branch: master, commit date: 2021-06-18 21:33, hash: f9aea19d98

Short description of error
Crashing during animation when using Geometry Nodes - when clicked on Attribute Randomize - Attribute field

Exact steps for others to reproduce the error
Open the file, start animation and click on the attribute search button:
scale.blend

OR:

Creating simple scene with an animation of rotating brush :

  • I added cylinder ( "Cylinder" ) with some loops cuts, assigned these loop cuts' vertices into vertex group ( "Group" ). Added one plane ( "Plane" ) with narrow size. Then Using Geometry Nodes on the "Cylinder" object with Point Instance ( Object = "Plane" ) + Point Distribute ( Density = "Group" ). Then I create keyframe on 0, then keyframe on 50 with cylinder rotation 180 deg, then keyframe on 100 with another rotation 180.
  • Then I start the animation and all works fine
  • Then I added Attribute Randomize into the Geometry Nodes for that Cylinder
  • When animation is stopped, all ok. But when animation is running and I click into Attribute Randomize -> Attribute field, it crashes ( tried 4 times )
**Blender Version** Broken: version: 2.93, 3.0.0 Alpha, branch: master, commit date: 2021-06-18 21:33, hash: `f9aea19d98` **Short description of error** Crashing during animation when using Geometry Nodes - when clicked on Attribute Randomize - Attribute field **Exact steps for others to reproduce the error** Open the file, start animation and click on the attribute search button: [scale.blend](https://archive.blender.org/developer/F10186580/scale.blend) OR: Creating simple scene with an animation of rotating brush : - I added cylinder ( "Cylinder" ) with some loops cuts, assigned these loop cuts' vertices into vertex group ( "Group" ). Added one plane ( "Plane" ) with narrow size. Then Using Geometry Nodes on the "Cylinder" object with Point Instance ( Object = "Plane" ) + Point Distribute ( Density = "Group" ). Then I create keyframe on 0, then keyframe on 50 with cylinder rotation 180 deg, then keyframe on 100 with another rotation 180. - Then I start the animation and all works fine - Then I added Attribute Randomize into the Geometry Nodes for that Cylinder - When animation is stopped, all ok. But when animation is running and I click into Attribute Randomize -> Attribute field, it crashes ( tried 4 times )
Author

Added subscriber: @PetrSmrtka

Added subscriber: @PetrSmrtka
Member

Added subscriber: @PratikPB2123

Added subscriber: @PratikPB2123
Member

Thanks for the report. Can you please provide a simple .blend file?

Thanks for the report. Can you please provide a simple .blend file?
Member

Changed status from 'Needs Triage' to: 'Needs User Info'

Changed status from 'Needs Triage' to: 'Needs User Info'

Added subscriber: @dfelinto

Added subscriber: @dfelinto

I can reproduce this with 2.93 and master. It crashes as soon as I go in the attribute search.

scale.blend

I can reproduce this with 2.93 and master. It crashes as soon as I go in the attribute search. [scale.blend](https://archive.blender.org/developer/F10186580/scale.blend)

Changed status from 'Needs User Info' to: 'Confirmed'

Changed status from 'Needs User Info' to: 'Confirmed'

For the records this is the bracktrace (for the main thread): P2191

For the records this is the bracktrace (for the main thread): [P2191](https://archive.blender.org/developer/P2191.txt)
Member

Added subscribers: @JulianEisel, @HooglyBoogly

Added subscribers: @JulianEisel, @HooglyBoogly
Member

Interesting. It's use-after-free of the attribute hints. I think this is the cause:

  • The attribute search button is created and given pointers to the evaluated geometry set.
  • Animation starts, and the modifier re-evaluates, freeing the evaluated geometry set to replace it with the one for the next frame.
  • The node editor (and most of the UI) is not redrawn to improve animation playback performance, meaning the button points to a freed geometry set.
  • You click the search, button-- crash.

The most straightforward solution is probably to disable attribute search when animation is playing, but this must be a relatively common problem in the UI.
@JulianEisel, is disabling the search generally the right approach?

Interesting. It's use-after-free of the attribute hints. I think this is the cause: - The attribute search button is created and given pointers to the evaluated geometry set. - Animation starts, and the modifier re-evaluates, freeing the evaluated geometry set to replace it with the one for the next frame. - The node editor (and most of the UI) is not redrawn to improve animation playback performance, meaning the button points to a freed geometry set. - You click the search, button-- crash. The most straightforward solution is probably to disable attribute search when animation is playing, but this must be a relatively common problem in the UI. @JulianEisel, is disabling the search generally the right approach?

I don't think it makes sense to disable attribute search. Although it seems harmless to do so now, it will be a problem when we have the physics clock detached from the animation clock.

I don't think it makes sense to disable attribute search. Although it seems harmless to do so now, it will be a problem when we have the physics clock detached from the animation clock.
Member

Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set.

Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set.
Member

Added subscriber: @JacquesLucke

Added subscriber: @JacquesLucke
Member

Just wanted to mention that tooltips are disabled as well when the animation is playing, not sure if the reasons are similar.

Just wanted to mention that tooltips are disabled as well when the animation is playing, not sure if the reasons are similar.
Member

Given the conversation above I don't know the best solution. Now that the node UI storage is stored on the modifier, at least attribute search works now, but it still crashes when you apply an attribute, because the underlying problem is the same-- AttributeSearchData has a pointer to an old node tree because the the UI isn't redrawn during animation.

Given the conversation above I don't know the best solution. Now that the node UI storage is stored on the modifier, at least attribute search works now, but it still crashes when you apply an attribute, because the underlying problem is the same-- `AttributeSearchData` has a pointer to an old node tree because the the UI isn't redrawn during animation.
Member

AttributeSearchData has a pointer to an old node tree because the the UI isn't redrawn during animation.

Not quite true. The pointer to the tree is fine (it's original dna data), the pointer to the GeometryAttributeInfo is outdated after the modifier ran again.

Here is an alternative solution that does not quite work yet, but could work if we do a refactor in the ui code: P2277.
The idea is, instead of referencing GeometryAttributeInfo, we just copy it into the "state" of the search uibut. This way we can't get a dangling pointer.
The reason this does not work yet, is because the free function passed to UI_but_func_search_set does not work as intended yet. We should just get rid of all those argN stuff, and just always have arg and arg_free. This would give us much more flexibility with what we can put into a uiBut. Not sure how much of a refactor that would be.

> `AttributeSearchData` has a pointer to an old node tree because the the UI isn't redrawn during animation. Not quite true. The pointer to the tree is fine (it's original dna data), the pointer to the `GeometryAttributeInfo` is outdated after the modifier ran again. Here is an alternative solution that does not quite work yet, but could work if we do a refactor in the ui code: [P2277](https://archive.blender.org/developer/P2277.txt). The idea is, instead of referencing `GeometryAttributeInfo`, we just copy it into the "state" of the search uibut. This way we can't get a dangling pointer. The reason this does not work yet, is because the free function passed to `UI_but_func_search_set` does not work as intended yet. We should just get rid of all those `argN` stuff, and just always have `arg` and `arg_free`. This would give us much more flexibility with what we can put into a `uiBut`. Not sure how much of a refactor that would be.
Member

I think some of what Jacques is mentioning might make sense, and issue is still really ugly from a code architecture perspective, since this node isn't exposed anymore I don't think this needs high priority.

I think some of what Jacques is mentioning might make sense, and issue is still really ugly from a code architecture perspective, since this node isn't exposed anymore I don't think this needs high priority.
Member

Well, after testing, this problem still applies in the modifier.

Well, after testing, this problem still applies in the modifier.
Member

In #89313#1184414, @JulianEisel wrote:
Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set.

Still wondering why this is not an option. A pointer to the pointer should be fine if it's only the pointed to memory that is recreated.

> In #89313#1184414, @JulianEisel wrote: > Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set. Still wondering why this is not an option. A pointer to the pointer should be fine if it's only the pointed to memory that is recreated.
Member

I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it.

I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it.
Hans Goudey was assigned by Dalai Felinto 2021-11-02 17:41:01 +01:00

Assigning to Hans since he said he will look into it.

Assigning to Hans since he said he will look into it.
Member

In #89313#1246073, @HooglyBoogly wrote:
I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it.

Don't think the original ID would be recreated then. But it may be on undo (esp. if the undone change was to the ID in question).

> In #89313#1246073, @HooglyBoogly wrote: > I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it. Don't think the original ID would be recreated then. But it may be on undo (esp. if the undone change was to the ID in question).
Member

Okay, maybe that will work then. We'll see if undo is still an issue.

I looked into this yesterday, ended up getting frustrated battling some warnings:

  const void *const *log_v = &nmd.runtime_eval_log;
  const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);
/home/hans/Blender-Git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1182:44: error: invalid ‘static_cast’ from type ‘const void* const*’ to type ‘const blender::nodes::geometry_nodes_eval_log::ModifierLog* const*’
 1182 |   const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);
      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/source/blender/modifiers/intern/MOD_nodes.cc b/source/blender/modifiers/intern/MOD_nodes.cc
index f87ff844acf..5e741708a03 100644
--- a/source/blender/modifiers/intern/MOD_nodes.cc
+++ b/source/blender/modifiers/intern/MOD_nodes.cc
@@ -1122,7 +1122,7 @@ static void modifyGeometrySet(ModifierData *md,
 }
 
 struct AttributeSearchData {
-  const geo_log::ModifierLog &modifier_log;
+  const geo_log::ModifierLog *const *modifier_log;
   IDProperty &name_property;
   bool is_output;
 };
@@ -1138,9 +1138,9 @@ static void attribute_search_update_fn(const bContext *UNUSED(C),
 {
   AttributeSearchData *data = static_cast<AttributeSearchData *>(arg);
 
-  const geo_log::GeometryValueLog *geometry_log = data->is_output ?
-                                                      data->modifier_log.output_geometry_log() :
-                                                      data->modifier_log.input_geometry_log();
+  const geo_log::GeometryValueLog *geometry_log =
+      data->is_output ? (*data->modifier_log)->output_geometry_log() :
+                        (*data->modifier_log)->input_geometry_log();
   if (geometry_log == nullptr) {
     return;
   }
@@ -1178,7 +1178,8 @@ static void add_attribute_search_button(uiLayout *layout,
                                         const bNodeSocket &socket,
                                         const bool is_output)
 {
-  const geo_log::ModifierLog *log = static_cast<geo_log::ModifierLog *>(nmd.runtime_eval_log);
+  const void *const *log_v = &nmd.runtime_eval_log;
+  const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);
   if (log == nullptr) {
     uiItemR(layout, md_ptr, rna_path_attribute_name.c_str(), 0, "", ICON_NONE);
     return;
@@ -1211,8 +1212,7 @@ static void add_attribute_search_button(uiLayout *layout,
     return;
   }
 
-  AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData,
-                                                 {*log, *property, is_output});
+  AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, {log, *property, is_output});
 
   UI_but_func_search_set_results_are_suggestions(but, true);
   UI_but_func_search_set_sep_string(but, UI_MENU_ARROW_SEP);

I'll look into it again tomorrow.

Okay, maybe that will work then. We'll see if undo is still an issue. I looked into this yesterday, ended up getting frustrated battling some warnings: ``` const void *const *log_v = &nmd.runtime_eval_log; const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); ``` ``` /home/hans/Blender-Git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1182:44: error: invalid ‘static_cast’ from type ‘const void* const*’ to type ‘const blender::nodes::geometry_nodes_eval_log::ModifierLog* const*’ 1182 | const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` ```lines=10 diff --git a/source/blender/modifiers/intern/MOD_nodes.cc b/source/blender/modifiers/intern/MOD_nodes.cc index f87ff844acf..5e741708a03 100644 --- a/source/blender/modifiers/intern/MOD_nodes.cc +++ b/source/blender/modifiers/intern/MOD_nodes.cc @@ -1122,7 +1122,7 @@ static void modifyGeometrySet(ModifierData *md, } struct AttributeSearchData { - const geo_log::ModifierLog &modifier_log; + const geo_log::ModifierLog *const *modifier_log; IDProperty &name_property; bool is_output; }; @@ -1138,9 +1138,9 @@ static void attribute_search_update_fn(const bContext *UNUSED(C), { AttributeSearchData *data = static_cast<AttributeSearchData *>(arg); - const geo_log::GeometryValueLog *geometry_log = data->is_output ? - data->modifier_log.output_geometry_log() : - data->modifier_log.input_geometry_log(); + const geo_log::GeometryValueLog *geometry_log = + data->is_output ? (*data->modifier_log)->output_geometry_log() : + (*data->modifier_log)->input_geometry_log(); if (geometry_log == nullptr) { return; } @@ -1178,7 +1178,8 @@ static void add_attribute_search_button(uiLayout *layout, const bNodeSocket &socket, const bool is_output) { - const geo_log::ModifierLog *log = static_cast<geo_log::ModifierLog *>(nmd.runtime_eval_log); + const void *const *log_v = &nmd.runtime_eval_log; + const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); if (log == nullptr) { uiItemR(layout, md_ptr, rna_path_attribute_name.c_str(), 0, "", ICON_NONE); return; @@ -1211,8 +1212,7 @@ static void add_attribute_search_button(uiLayout *layout, return; } - AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, - {*log, *property, is_output}); + AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, {log, *property, is_output}); UI_but_func_search_set_results_are_suggestions(but, true); UI_but_func_search_set_sep_string(but, UI_MENU_ARROW_SEP); ``` I'll look into it again tomorrow.

This issue was referenced by 22ffd69a91

This issue was referenced by 22ffd69a91c9287e4f61e620ec2beaf9b1ff22c1
Member

Changed status from 'Confirmed' to: 'Resolved'

Changed status from 'Confirmed' to: 'Resolved'
Sign in to join this conversation.
No Label
Interest
Alembic
Interest
Animation & Rigging
Interest
Asset Browser
Interest
Asset Browser Project Overview
Interest
Audio
Interest
Automated Testing
Interest
Blender Asset Bundle
Interest
BlendFile
Interest
Collada
Interest
Compatibility
Interest
Compositing
Interest
Core
Interest
Cycles
Interest
Dependency Graph
Interest
Development Management
Interest
EEVEE
Interest
EEVEE & Viewport
Interest
Freestyle
Interest
Geometry Nodes
Interest
Grease Pencil
Interest
ID Management
Interest
Images & Movies
Interest
Import Export
Interest
Line Art
Interest
Masking
Interest
Metal
Interest
Modeling
Interest
Modifiers
Interest
Motion Tracking
Interest
Nodes & Physics
Interest
OpenGL
Interest
Overlay
Interest
Overrides
Interest
Performance
Interest
Physics
Interest
Pipeline, Assets & IO
Interest
Platforms, Builds & Tests
Interest
Python API
Interest
Render & Cycles
Interest
Render Pipeline
Interest
Sculpt, Paint & Texture
Interest
Text Editor
Interest
Translations
Interest
Triaging
Interest
Undo
Interest
USD
Interest
User Interface
Interest
UV Editing
Interest
VFX & Video
Interest
Video Sequencer
Interest
Virtual Reality
Interest
Vulkan
Interest
Wayland
Interest
Workbench
Interest: X11
Legacy
Blender 2.8 Project
Legacy
Milestone 1: Basic, Local Asset Browser
Legacy
OpenGL Error
Meta
Good First Issue
Meta
Papercut
Meta
Retrospective
Meta
Security
Module
Animation & Rigging
Module
Core
Module
Development Management
Module
EEVEE & Viewport
Module
Grease Pencil
Module
Modeling
Module
Nodes & Physics
Module
Pipeline, Assets & IO
Module
Platforms, Builds & Tests
Module
Python API
Module
Render & Cycles
Module
Sculpt, Paint & Texture
Module
Triaging
Module
User Interface
Module
VFX & Video
Platform
FreeBSD
Platform
Linux
Platform
macOS
Platform
Windows
Priority
High
Priority
Low
Priority
Normal
Priority
Unbreak Now!
Status
Archived
Status
Confirmed
Status
Duplicate
Status
Needs Info from Developers
Status
Needs Information from User
Status
Needs Triage
Status
Resolved
Type
Bug
Type
Design
Type
Known Issue
Type
Patch
Type
Report
Type
To Do
No Milestone
No project
No Assignees
7 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#89313
No description provided.