Blender crash after maximizing/unmaximizing an editor (debug build only) #96956

New Issue

Yann Lanthony · 2022-04-01T17:29:27+02:00

Yann Lanthony commented

2022-04-01 17:29:27 +02:00

Blender Version
Broken: master - debug build
Works: master - release build
OS: Tested on both Windows and Linux

Short description of error
With a debug build, Blender crashes after maximizing an editor + moving mouse + unmaximizing.
It does not seem to be reproducible with a release build.

Exact steps for others to reproduce the error

Open Blender default scene
Maximize the 3D viewport with CTRL+SPACE
Move the mouse
Unmaximize with CTRL+SPACE

Debug info
The crash happens in wm_event_do_handlers when calling wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak(wmWindow *win, bScreen *screen).
In that case, screen points to invalid (freed?) memory.

**Blender Version** Broken: master - debug build Works: master - release build OS: Tested on both Windows and Linux **Short description of error** With a debug build, Blender crashes after maximizing an editor + moving mouse + unmaximizing. It does not seem to be reproducible with a release build. **Exact steps for others to reproduce the error** - Open Blender default scene - Maximize the 3D viewport with CTRL+SPACE - Move the mouse - Unmaximize with CTRL+SPACE **Debug info** The crash happens in `wm_event_do_handlers` when calling `wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak(wmWindow *win, bScreen *screen)`. In that case, `screen` points to invalid (freed?) memory.

Yann Lanthony commented

2022-04-01 17:29:27 +02:00

Added subscriber: @yann-lty

Falk David commented

2022-04-01 17:30:49 +02:00

Added subscriber: @filedescriptor

Falk David commented

2022-04-01 17:30:49 +02:00

On linux I get this with a debug ASAN build:

==65428==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130003c2e68 at pc 0x000008e44973 bp 0x7fffa62fd550 sp 0x7fffa62fd540
READ of size 8 at 0x6130003c2e68 thread T0
    - 0 0x8e44972 in ED_screen_areas_iter_next /blender/source/blender/editors/screen/area.c:3498
    - 1 0x648f3e3 in wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak /blender/source/blender/windowmanager/intern/wm_event_system.c:1306
    - 2 0x64acb9a in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3892
    - 3 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623
    - 4 0x3eff869 in main /blender/source/creator/creator.c:547
    - 5 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    - 6 0x7f5667fe907c in __libc_start_main_impl ../csu/libc-start.c:409
    - 7 0x3efe994 in _start (/build_linux_debug/bin/blender+0x3efe994)

0x6130003c2e68 is located 232 bytes inside of 328-byte region [0x6130003c2d80,0x6130003c2ec8)
freed by thread T0 here:
    - 0 0x7f56685c9517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    - 1 0x229ae863 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:116
    - 2 0x4263477 in BKE_id_free_ex /blender/source/blender/blenkernel/intern/lib_id_delete.c:162
    - 3 0x42634ac in BKE_id_free /blender/source/blender/blenkernel/intern/lib_id_delete.c:168
    - 4 0x57f9c9c in BKE_workspace_layout_remove /blender/source/blender/blenkernel/intern/workspace.c:378
    - 5 0x8e6f71b in ED_screen_state_toggle /blender/source/blender/editors/screen/screen_edit.c:1482
    - 6 0x8ea60bb in screen_maximize_area_exec /blender/source/blender/editors/screen/screen_ops.c:3315
    - 7 0x6490d86 in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.c:1400
    - 8 0x649add2 in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:2400
    - 9 0x649ef85 in wm_handlers_do_keymap_with_keymap_handler /blender/source/blender/windowmanager/intern/wm_event_system.c:2754
    - 10 0x64a286e in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:3076
    - 11 0x64a3cb2 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:3216
    - 12 0x64ac517 in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3867
    - 13 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623
    - 14 0x3eff869 in main /blender/source/creator/creator.c:547
    - 15 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

previously allocated by thread T0 here:
    - 0 0x7f56685c9a37 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
    - 1 0x229aefa8 in MEM_lockfree_callocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:222
    - 2 0x425585b in BKE_libblock_alloc_notest /blender/source/blender/blenkernel/intern/lib_id.c:1042
    - 3 0x42559f2 in BKE_libblock_alloc /blender/source/blender/blenkernel/intern/lib_id.c:1054
    - 4 0x8e5bc48 in screen_add /blender/source/blender/editors/screen/screen_edit.c:192
    - 5 0x8ec242d in ED_workspace_layout_add /blender/source/blender/editors/screen/workspace_layout_edit.c:35
    - 6 0x8e6d531 in screen_state_to_nonnormal /blender/source/blender/editors/screen/screen_edit.c:1355
    - 7 0x8e6f8eb in ED_screen_state_toggle /blender/source/blender/editors/screen/screen_edit.c:1500
    - 8 0x8ea60bb in screen_maximize_area_exec /blender/source/blender/editors/screen/screen_ops.c:3315
    - 9 0x6490d86 in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.c:1400
    - 10 0x649add2 in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:2400
    - 11 0x649ef85 in wm_handlers_do_keymap_with_keymap_handler /blender/source/blender/windowmanager/intern/wm_event_system.c:2754
    - 12 0x64a286e in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:3076
    - 13 0x64a3cb2 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:3216
    - 14 0x64ac517 in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3867
    - 15 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623
    - 16 0x3eff869 in main /blender/source/creator/creator.c:547
    - 17 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/editors/screen/area.c:3498 in ED_screen_areas_iter_next
Shadow bytes around the buggy address:
  0x0c2680070570: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c2680070580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680070590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c26800705a0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
  0x0c26800705b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c26800705c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd
  0x0c26800705d0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
  0x0c26800705e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c26800705f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680070600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2680070610: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==65428==ABORTING

On linux I get this with a debug ASAN build: ``` ==65428==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130003c2e68 at pc 0x000008e44973 bp 0x7fffa62fd550 sp 0x7fffa62fd540 READ of size 8 at 0x6130003c2e68 thread T0 - 0 0x8e44972 in ED_screen_areas_iter_next /blender/source/blender/editors/screen/area.c:3498 - 1 0x648f3e3 in wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak /blender/source/blender/windowmanager/intern/wm_event_system.c:1306 - 2 0x64acb9a in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3892 - 3 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623 - 4 0x3eff869 in main /blender/source/creator/creator.c:547 - 5 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 - 6 0x7f5667fe907c in __libc_start_main_impl ../csu/libc-start.c:409 - 7 0x3efe994 in _start (/build_linux_debug/bin/blender+0x3efe994) 0x6130003c2e68 is located 232 bytes inside of 328-byte region [0x6130003c2d80,0x6130003c2ec8) freed by thread T0 here: - 0 0x7f56685c9517 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 - 1 0x229ae863 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:116 - 2 0x4263477 in BKE_id_free_ex /blender/source/blender/blenkernel/intern/lib_id_delete.c:162 - 3 0x42634ac in BKE_id_free /blender/source/blender/blenkernel/intern/lib_id_delete.c:168 - 4 0x57f9c9c in BKE_workspace_layout_remove /blender/source/blender/blenkernel/intern/workspace.c:378 - 5 0x8e6f71b in ED_screen_state_toggle /blender/source/blender/editors/screen/screen_edit.c:1482 - 6 0x8ea60bb in screen_maximize_area_exec /blender/source/blender/editors/screen/screen_ops.c:3315 - 7 0x6490d86 in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.c:1400 - 8 0x649add2 in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:2400 - 9 0x649ef85 in wm_handlers_do_keymap_with_keymap_handler /blender/source/blender/windowmanager/intern/wm_event_system.c:2754 - 10 0x64a286e in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:3076 - 11 0x64a3cb2 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:3216 - 12 0x64ac517 in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3867 - 13 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623 - 14 0x3eff869 in main /blender/source/creator/creator.c:547 - 15 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 previously allocated by thread T0 here: - 0 0x7f56685c9a37 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154 - 1 0x229aefa8 in MEM_lockfree_callocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:222 - 2 0x425585b in BKE_libblock_alloc_notest /blender/source/blender/blenkernel/intern/lib_id.c:1042 - 3 0x42559f2 in BKE_libblock_alloc /blender/source/blender/blenkernel/intern/lib_id.c:1054 - 4 0x8e5bc48 in screen_add /blender/source/blender/editors/screen/screen_edit.c:192 - 5 0x8ec242d in ED_workspace_layout_add /blender/source/blender/editors/screen/workspace_layout_edit.c:35 - 6 0x8e6d531 in screen_state_to_nonnormal /blender/source/blender/editors/screen/screen_edit.c:1355 - 7 0x8e6f8eb in ED_screen_state_toggle /blender/source/blender/editors/screen/screen_edit.c:1500 - 8 0x8ea60bb in screen_maximize_area_exec /blender/source/blender/editors/screen/screen_ops.c:3315 - 9 0x6490d86 in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.c:1400 - 10 0x649add2 in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:2400 - 11 0x649ef85 in wm_handlers_do_keymap_with_keymap_handler /blender/source/blender/windowmanager/intern/wm_event_system.c:2754 - 12 0x64a286e in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:3076 - 13 0x64a3cb2 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:3216 - 14 0x64ac517 in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:3867 - 15 0x646c31d in WM_main /blender/source/blender/windowmanager/intern/wm.c:623 - 16 0x3eff869 in main /blender/source/creator/creator.c:547 - 17 0x7f5667fe8fcf in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/editors/screen/area.c:3498 in ED_screen_areas_iter_next Shadow bytes around the buggy address: 0x0c2680070570: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2680070580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2680070590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c26800705a0: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa 0x0c26800705b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c26800705c0: fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd 0x0c26800705d0: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa 0x0c26800705e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c26800705f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2680070600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2680070610: fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==65428==ABORTING ```

Pratik Borhade commented

2022-04-01 17:48:04 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Harley Acheson commented

2022-04-01 19:31:52 +02:00

Added subscribers: @ideasman42, @Harley

Harley Acheson commented

2022-04-01 19:31:53 +02:00

This fixes it, but no idea how the screen becomes invalid:

diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c
index 84c40c42adcf..9bd7a338f6c2 100644
--- a/source/blender/windowmanager/intern/wm_event_system.c
+++ b/source/blender/windowmanager/intern/wm_event_system.c
@@ -3889,6 +3889,7 @@ void wm_event_do_handlers(bContext *C)
       }
 
       if (event_queue_check_drag_prev && (win->event_queue_check_drag == false)) {
+        screen = WM_window_get_active_screen(win);
         wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak(win, screen);
       }

Sounds like something for @ideasman42

This fixes it, but no idea how the screen becomes invalid: ``` diff --git a/source/blender/windowmanager/intern/wm_event_system.c b/source/blender/windowmanager/intern/wm_event_system.c index 84c40c42adcf..9bd7a338f6c2 100644 --- a/source/blender/windowmanager/intern/wm_event_system.c +++ b/source/blender/windowmanager/intern/wm_event_system.c @@ -3889,6 +3889,7 @@ void wm_event_do_handlers(bContext *C) } if (event_queue_check_drag_prev && (win->event_queue_check_drag == false)) { + screen = WM_window_get_active_screen(win); wm_region_tag_draw_on_gizmo_delay_refresh_for_tweak(win, screen); } ``` Sounds like something for @ideasman42

Philipp Oeser removed the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Blender crash after maximizing/unmaximizing an editor (debug build only) #96956