Crash undoing creation of Viewer or Split Viewer node (compositor) #92148

Closed
opened 2021-10-12 16:19:12 +02:00 by Georg K · 12 comments

System Information
Operating system: Linux-5.14.7-2-MANJARO-x86_64-with-glibc2.33 64 Bits
Graphics card: AMD VERDE (DRM 2.50.0, 5.14.7-2-MANJARO, LLVM 12.0.1) AMD 4.5 (Core Profile) Mesa 21.2.2

Blender Version
Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-10-12 13:12, hash: b7b2103cf7
Worked: 2.93.0

Short description of error
Blender crashes when using undo after creating a Viewer or Split Viewer node. It does not happen with other nodes.
If I deactivate Global Undo, there is no undo at all in the compositor or the 3D viewport.

Exact steps for others to reproduce the error

  • In the default scene, switch to compositor
  • Check Use Nodes
  • Create a Viewer or Split Viewer node
  • Undo multiple times until crash occurs

Looks like use after free of tex

P2493: (An Untitled Masterwork)

>	blender.exe!GPU_texture_free(GPUTexture * tex_) Line 523	C++
 	blender.exe!image_free_gpu(Image * ima, const bool immediate) Line 556	C
 	blender.exe!BKE_image_free_gputextures(Image * ima) Line 590	C
 	blender.exe!BKE_image_free_buffers_ex(Image * ima, bool do_lock) Line 528	C
 	blender.exe!BKE_image_free_buffers(Image * ima) Line 540	C
 	blender.exe!image_free_data(ID * id) Line 179	C
 	blender.exe!BKE_libblock_free_datablock(ID * id, const int UNUSED_flag) Line 87	C
 	blender.exe!BKE_id_free_ex(Main * bmain, void * idv, int flag, const bool use_flag_from_idtag) Line 164	C
 	blender.exe!BKE_main_free(Main * mainvar) Line 191	C
 	blender.exe!BKE_blender_globals_clear() Line 184	C
 	blender.exe!setup_app_data(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 285	C
 	blender.exe!setup_app_blend_file_data(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 435	C
 	blender.exe!BKE_blendfile_read_setup_ex(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports, const bool startup_update_defaults, const unsigned char * startup_app_template) Line 472	C
 	blender.exe!BKE_blendfile_read_setup(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 481	C
 	blender.exe!BKE_memfile_undo_decode(MemFileUndoData * mfu, const eUndoStepDir undo_direction, const bool use_old_bmain_data, bContext * C) Line 98	C
 	blender.exe!memfile_undosys_step_decode(bContext * C, Main * bmain, UndoStep * us_p, const eUndoStepDir undo_direction, bool UNUSED_is_final) Line 195	C
 	blender.exe!undosys_step_decode(bContext * C, Main * bmain, UndoStack * ustack, UndoStep * us, const eUndoStepDir dir, bool is_final) Line 216	C
 	blender.exe!BKE_undosys_step_load_data_ex(UndoStack * ustack, bContext * C, UndoStep * us_target, UndoStep * us_reference, const bool use_skip) Line 828	C
 	blender.exe!BKE_undosys_step_undo_with_data_ex(UndoStack * ustack, bContext * C, UndoStep * us_target, bool use_skip) Line 889	C
 	blender.exe!BKE_undosys_step_undo_with_data(UndoStack * ustack, bContext * C, UndoStep * us_target) Line 899	C
 	blender.exe!BKE_undosys_step_undo(UndoStack * ustack, bContext * C) Line 907	C
 	blender.exe!ed_undo_step_direction(bContext * C, eUndoStepDir step, ReportList * reports) Line 306	C
 	blender.exe!ed_undo_exec(bContext * C, wmOperator * op) Line 520	C
 	blender.exe!wm_operator_invoke(bContext * C, wmOperatorType * ot, wmEvent * event, PointerRNA * properties, ReportList * reports, const bool poll_only, bool use_last_properties) Line 1363	C
 	blender.exe!wm_handler_operator_call(bContext * C, ListBase * handlers, wmEventHandler * handler_base, wmEvent * event, PointerRNA * properties, const unsigned char * kmi_idname) Line 2348	C
 	blender.exe!wm_handlers_do_keymap_with_keymap_handler(bContext * C, wmEvent * event, ListBase * handlers, wmEventHandler_Keymap * handler, wmKeyMap * keymap, const bool do_debug_handler) Line 2700	C
 	blender.exe!wm_handlers_do_intern(bContext * C, wmEvent * event, ListBase * handlers) Line 3027	C
 	blender.exe!wm_handlers_do(bContext * C, wmEvent * event, ListBase * handlers) Line 3164	C
 	blender.exe!wm_event_do_handlers(bContext * C) Line 3766	C
 	blender.exe!WM_main(bContext * C) Line 650	C
 	blender.exe!main(int argc, const unsigned char * * UNUSED_argv_c) Line 562	C
 	[External Code]	

**System Information** Operating system: Linux-5.14.7-2-MANJARO-x86_64-with-glibc2.33 64 Bits Graphics card: AMD VERDE (DRM 2.50.0, 5.14.7-2-MANJARO, LLVM 12.0.1) AMD 4.5 (Core Profile) Mesa 21.2.2 **Blender Version** Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-10-12 13:12, hash: `b7b2103cf7` Worked: 2.93.0 **Short description of error** Blender crashes when using undo after creating a Viewer or Split Viewer node. It does not happen with other nodes. If I deactivate Global Undo, there is no undo at all in the compositor or the 3D viewport. **Exact steps for others to reproduce the error** - In the default scene, switch to compositor - Check Use Nodes - Create a Viewer or Split Viewer node - Undo multiple times until crash occurs Looks like use after free of `tex` [P2493: (An Untitled Masterwork)](https://archive.blender.org/developer/P2493.txt) ``` > blender.exe!GPU_texture_free(GPUTexture * tex_) Line 523 C++ blender.exe!image_free_gpu(Image * ima, const bool immediate) Line 556 C blender.exe!BKE_image_free_gputextures(Image * ima) Line 590 C blender.exe!BKE_image_free_buffers_ex(Image * ima, bool do_lock) Line 528 C blender.exe!BKE_image_free_buffers(Image * ima) Line 540 C blender.exe!image_free_data(ID * id) Line 179 C blender.exe!BKE_libblock_free_datablock(ID * id, const int UNUSED_flag) Line 87 C blender.exe!BKE_id_free_ex(Main * bmain, void * idv, int flag, const bool use_flag_from_idtag) Line 164 C blender.exe!BKE_main_free(Main * mainvar) Line 191 C blender.exe!BKE_blender_globals_clear() Line 184 C blender.exe!setup_app_data(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 285 C blender.exe!setup_app_blend_file_data(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 435 C blender.exe!BKE_blendfile_read_setup_ex(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports, const bool startup_update_defaults, const unsigned char * startup_app_template) Line 472 C blender.exe!BKE_blendfile_read_setup(bContext * C, BlendFileData * bfd, const BlendFileReadParams * params, BlendFileReadReport * reports) Line 481 C blender.exe!BKE_memfile_undo_decode(MemFileUndoData * mfu, const eUndoStepDir undo_direction, const bool use_old_bmain_data, bContext * C) Line 98 C blender.exe!memfile_undosys_step_decode(bContext * C, Main * bmain, UndoStep * us_p, const eUndoStepDir undo_direction, bool UNUSED_is_final) Line 195 C blender.exe!undosys_step_decode(bContext * C, Main * bmain, UndoStack * ustack, UndoStep * us, const eUndoStepDir dir, bool is_final) Line 216 C blender.exe!BKE_undosys_step_load_data_ex(UndoStack * ustack, bContext * C, UndoStep * us_target, UndoStep * us_reference, const bool use_skip) Line 828 C blender.exe!BKE_undosys_step_undo_with_data_ex(UndoStack * ustack, bContext * C, UndoStep * us_target, bool use_skip) Line 889 C blender.exe!BKE_undosys_step_undo_with_data(UndoStack * ustack, bContext * C, UndoStep * us_target) Line 899 C blender.exe!BKE_undosys_step_undo(UndoStack * ustack, bContext * C) Line 907 C blender.exe!ed_undo_step_direction(bContext * C, eUndoStepDir step, ReportList * reports) Line 306 C blender.exe!ed_undo_exec(bContext * C, wmOperator * op) Line 520 C blender.exe!wm_operator_invoke(bContext * C, wmOperatorType * ot, wmEvent * event, PointerRNA * properties, ReportList * reports, const bool poll_only, bool use_last_properties) Line 1363 C blender.exe!wm_handler_operator_call(bContext * C, ListBase * handlers, wmEventHandler * handler_base, wmEvent * event, PointerRNA * properties, const unsigned char * kmi_idname) Line 2348 C blender.exe!wm_handlers_do_keymap_with_keymap_handler(bContext * C, wmEvent * event, ListBase * handlers, wmEventHandler_Keymap * handler, wmKeyMap * keymap, const bool do_debug_handler) Line 2700 C blender.exe!wm_handlers_do_intern(bContext * C, wmEvent * event, ListBase * handlers) Line 3027 C blender.exe!wm_handlers_do(bContext * C, wmEvent * event, ListBase * handlers) Line 3164 C blender.exe!wm_event_do_handlers(bContext * C) Line 3766 C blender.exe!WM_main(bContext * C) Line 650 C blender.exe!main(int argc, const unsigned char * * UNUSED_argv_c) Line 562 C [External Code] ```
Author

Added subscriber: @georgK

Added subscriber: @georgK

Added subscriber: @iss

Added subscriber: @iss

Changed status from 'Needs Triage' to: 'Needs User Info'

Changed status from 'Needs Triage' to: 'Needs User Info'

Can't reproduce crash.

create a Viewer or Split Viewer node (or Shift-click on the Render Layers to connect a viewer node)

This feature is provided by Node Wrangler addon, can you check if it crashes without this addon? And also with this addon only?

Can't reproduce crash. > create a Viewer or Split Viewer node (or Shift-click on the Render Layers to connect a viewer node) This feature is provided by Node Wrangler addon, can you check if it crashes without this addon? And also with this addon only?
Author

Ctrl-click to connect a viewer is actually not part of the addon, also happened with it deactivated as well as with blender --factory-startup and with blender --factory-startup + only NodeWrangler addon activated. Using ctrl-click is not necessary for the crash to occur, the nodes can be added from the Add menu.

Ctrl-click to connect a viewer is actually not part of the addon, also happened with it deactivated as well as with blender --factory-startup and with blender --factory-startup + only NodeWrangler addon activated. Using ctrl-click is not necessary for the crash to occur, the nodes can be added from the Add menu.

Oops my bad, I wrongly assumed because Shift-click did nothing for me so I went looking for this... Anyway, if this is not important probably best to omit from steps.

It took some fuzzing, but I was able to reproduce now.

Since it looks like use after free, I am trying to check with ASAN but it seems to go into infinite loop when I add viewer node.

Oops my bad, I wrongly assumed because Shift-click did nothing for me so I went looking for this... Anyway, if this is not important probably best to omit from steps. It took some fuzzing, but I was able to reproduce now. Since it looks like use after free, I am trying to check with ASAN but it seems to go into infinite loop when I add viewer node.

Changed status from 'Needs User Info' to: 'Confirmed'

Changed status from 'Needs User Info' to: 'Confirmed'
Member

Added subscriber: @PratikPB2123

Added subscriber: @PratikPB2123
Member

Hi @iss , may be similar to #91294 (Draw: Crash on undo after adding new texture)
(At least the stack trace is same)

Hi @iss , may be similar to #91294 (Draw: Crash on undo after adding new texture) (At least the stack trace is same)

Thanks, yes, that would be it probably.. I reported same thing too with completely different steps and nobody was able to reproduce, so there will be probably more of these.

Will merge then

Thanks, yes, that would be it probably.. I reported same thing too with completely different steps and nobody was able to reproduce, so there will be probably more of these. Will merge then

Closed as duplicate of #91294

Closed as duplicate of #91294
Author

In #92148#1234541, @iss wrote:
Oops my bad, I wrongly assumed because Shift-click did nothing for me so I went looking for this...

Sorry my bad, too - I meant Ctrl-Shift-click.

> In #92148#1234541, @iss wrote: > Oops my bad, I wrongly assumed because Shift-click did nothing for me so I went looking for this... Sorry my bad, too - I meant Ctrl-Shift-click.
Sign in to join this conversation.
No Label
Interest
Alembic
Interest
Animation & Rigging
Interest
Asset Browser
Interest
Asset Browser Project Overview
Interest
Audio
Interest
Automated Testing
Interest
Blender Asset Bundle
Interest
BlendFile
Interest
Collada
Interest
Compatibility
Interest
Compositing
Interest
Core
Interest
Cycles
Interest
Dependency Graph
Interest
Development Management
Interest
EEVEE
Interest
EEVEE & Viewport
Interest
Freestyle
Interest
Geometry Nodes
Interest
Grease Pencil
Interest
ID Management
Interest
Images & Movies
Interest
Import Export
Interest
Line Art
Interest
Masking
Interest
Metal
Interest
Modeling
Interest
Modifiers
Interest
Motion Tracking
Interest
Nodes & Physics
Interest
OpenGL
Interest
Overlay
Interest
Overrides
Interest
Performance
Interest
Physics
Interest
Pipeline, Assets & IO
Interest
Platforms, Builds & Tests
Interest
Python API
Interest
Render & Cycles
Interest
Render Pipeline
Interest
Sculpt, Paint & Texture
Interest
Text Editor
Interest
Translations
Interest
Triaging
Interest
Undo
Interest
USD
Interest
User Interface
Interest
UV Editing
Interest
VFX & Video
Interest
Video Sequencer
Interest
Virtual Reality
Interest
Vulkan
Interest
Wayland
Interest
Workbench
Interest: X11
Legacy
Blender 2.8 Project
Legacy
Milestone 1: Basic, Local Asset Browser
Legacy
OpenGL Error
Meta
Good First Issue
Meta
Papercut
Meta
Retrospective
Meta
Security
Module
Animation & Rigging
Module
Core
Module
Development Management
Module
EEVEE & Viewport
Module
Grease Pencil
Module
Modeling
Module
Nodes & Physics
Module
Pipeline, Assets & IO
Module
Platforms, Builds & Tests
Module
Python API
Module
Render & Cycles
Module
Sculpt, Paint & Texture
Module
Triaging
Module
User Interface
Module
VFX & Video
Platform
FreeBSD
Platform
Linux
Platform
macOS
Platform
Windows
Priority
High
Priority
Low
Priority
Normal
Priority
Unbreak Now!
Status
Archived
Status
Confirmed
Status
Duplicate
Status
Needs Info from Developers
Status
Needs Information from User
Status
Needs Triage
Status
Resolved
Type
Bug
Type
Design
Type
Known Issue
Type
Patch
Type
Report
Type
To Do
No Milestone
No project
No Assignees
3 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#92148
No description provided.