Crash on undo in Heist production files after recent changes in mesh data #100875

New Issue

Bastien Montagne · 2022-09-07T13:09:11+02:00

Bastien Montagne commented

2022-09-07 13:09:11 +02:00

With current master, any undo in some Heist production files (checked at least with 010_0020.anim.blend r1965) crashes on invalid memory access in some mesh data.

Cannot reproduce yet from scratch in simple files, still investigating what is exactly the issue.

Caused by 05952aa94d.

ASAN trace-back:

==1955045==ERROR: AddressSanitizer: heap-use-after-free on address 0x603016042ab8 at pc 0x7f3a2b64814b bp 0x7f3a167b2c40 sp 0x7f3a167b23f0
READ of size 16 at 0x603016042ab8 thread T22
    - 0 0x7f3a2b64814a in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
    - 1 0x14e8cb4 in layerCopy_mdeformvert(void const*, void*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8cb4)
    - 2 0x1503d85 in customData_add_layer__internal(CustomData*, int, eCDAllocType, void*, int, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1503d85)
    - 3 0x14fbfef in CustomData_merge (/home/guest/blender/build_master_lite/bin/blender+0x14fbfef)
    - 4 0x14fda53 in CustomData_copy (/home/guest/blender/build_master_lite/bin/blender+0x14fda53)
    - 5 0x8fce3e in mesh_copy_data(Main*, ID*, ID const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x8fce3e)
    - 6 0x7e5b9b in BKE_id_copy_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id.c:636
    - 7 0x2b8cd40 in blender::deg::(anonymous namespace)::id_copy_inplace_no_main(ID const*, ID*) (/home/guest/blender/build_master_lite/bin/blender+0x2b8cd40)
    - 8 0x2b90fb3 in blender::deg::(anonymous namespace)::deg_expand_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b90fb3)
    - 9 0x2b918d0 in blender::deg::deg_update_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b918d0)
    - 10 0x2b9271e in blender::deg::deg_evaluate_copy_on_write(Depsgraph*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b9271e)
    - 11 0x2c11741 in blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}::operator()(Depsgraph*) const (/home/guest/blender/build_master_lite/bin/blender+0x2c11741)
    - 12 0x2c63b4c in void std::__invoke_impl<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>(std::__invoke_other, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c63b4c)
    - 13 0x2c5a6c4 in std::enable_if<is_invocable_r_v<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>, void>::type std::__invoke_r<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>(blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c5a6c4)
    - 14 0x2c54b6d in std::_Function_handler<void (Depsgraph*), blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}>::_M_invoke(std::_Any_data const&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c54b6d)
    - 15 0x2b896b0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const (/home/guest/blender/build_master_lite/bin/blender+0x2b896b0)
    - 16 0x2b840b2 in blender::deg::(anonymous namespace)::evaluate_node(blender::deg::(anonymous namespace)::DepsgraphEvalState const*, blender::deg::OperationNode*) (/home/guest/blender/build_master_lite/bin/blender+0x2b840b2)
    - 17 0x2b8437b in blender::deg::(anonymous namespace)::deg_task_run_func(TaskPool*, void*) (/home/guest/blender/build_master_lite/bin/blender+0x2b8437b)
    - 18 0xa4bef02 in Task::operator()() const (/home/guest/blender/build_master_lite/bin/blender+0xa4bef02)
    - 19 0xa4c3790 in tbb::internal::function_task<Task>::execute() (/home/guest/blender/build_master_lite/bin/blender+0xa4c3790)
    - 20 0x7f3a2be58ff4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/opt/lib/tbb/lib/libtbb.so+0x2cff4)
    - 21 0x7f3a2be59382 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/opt/lib/tbb/lib/libtbb.so+0x2d382)
    - 22 0x7f3a2be3efb6 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/opt/lib/tbb/lib/libtbb.so+0x12fb6)
    - 23 0x7f3a2be4e06f in tbb::internal::market::process(rml::job&) (/opt/lib/tbb/lib/libtbb.so+0x2206f)
    - 24 0x7f3a2be5205b in tbb::internal::rml::private_worker::run() (/opt/lib/tbb/lib/libtbb.so+0x2605b)
    - 25 0x7f3a2be52298 in tbb::internal::rml::private_worker::thread_routine(void*) (/opt/lib/tbb/lib/libtbb.so+0x26298)
    - 26 0x7f3a27c87b26 in start_thread nptl/pthread_create.c:435
    - 27 0x7f3a27d0a78b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x603016042ab8 is located 8 bytes inside of 24-byte region [0x603016042ab0,0x603016042ac8)
freed by thread T0 here:
    - 0 0x7f3a2b6b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52
    - 1 0xa4ece12 in MEM_lockfree_freeN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:117
    - 2 0x14e8eb7 in layerFree_mdeformvert(void*, int, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8eb7)
    - 3 0x14fe16e in customData_free_layer__internal(CustomDataLayer*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14fe16e)
    - 4 0x14fe545 in CustomData_free (/home/guest/blender/build_master_lite/bin/blender+0x14fe545)
    - 5 0x90b852 in mesh_clear_geometry(Mesh*) (/home/guest/blender/build_master_lite/bin/blender+0x90b852)
    - 6 0x8fde45 in mesh_free_data(ID*) (/home/guest/blender/build_master_lite/bin/blender+0x8fde45)
    - 7 0x7f54df in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:73
    - 8 0x7f5a3f in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:132
    - 9 0x8639e2 in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:61
    - 10 0x49cc32 in BKE_blender_globals_clear /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:164
    - 11 0x83b6b27 in setup_app_data /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:291
    - 12 0x83b8225 in setup_app_blend_file_data /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:446
    - 13 0x83b8642 in BKE_blendfile_read_setup_ex /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:476
    - 14 0x83b868d in BKE_blendfile_read_setup /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:485
    - 15 0x83b3f74 in BKE_memfile_undo_decode /home/guest/blender/src/source/blender/blenkernel/intern/blender_undo.c:83
    - 16 0x70073fd in memfile_undosys_step_decode /home/guest/blender/src/source/blender/editors/undo/memfile_undo.c:210
    - 17 0x873506f in undosys_step_decode /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:200
    - 18 0x873b4c9 in BKE_undosys_step_load_data_ex /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:780
    - 19 0x873b964 in BKE_undosys_step_undo_with_data_ex /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:826
    - 20 0x873b993 in BKE_undosys_step_undo_with_data /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:831
    - 21 0x873bad5 in BKE_undosys_step_undo /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:837
    - 22 0x6fff2b9 in ed_undo_step_direction /home/guest/blender/src/source/blender/editors/undo/ed_undo.c:287
    - 23 0x7000f2a in ed_undo_exec /home/guest/blender/src/source/blender/editors/undo/ed_undo.c:503
    - 24 0x1ff290c in wm_operator_invoke(bContext*, wmOperatorType*, wmEvent const*, PointerRNA*, ReportList*, bool, bool) (/home/guest/blender/build_master_lite/bin/blender+0x1ff290c)
    - 25 0x1ffcbf0 in wm_handler_operator_call(bContext*, ListBase*, wmEventHandler*, wmEvent*, PointerRNA*, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1ffcbf0)
    - 26 0x200115d in wm_handlers_do_keymap_with_keymap_handler(bContext*, wmEvent*, ListBase*, wmEventHandler_Keymap*, wmKeyMap*, bool) (/home/guest/blender/build_master_lite/bin/blender+0x200115d)
    - 27 0x200443b in wm_handlers_do_intern(bContext*, wmWindow*, wmEvent*, ListBase*) (/home/guest/blender/build_master_lite/bin/blender+0x200443b)
    - 28 0x200584d in wm_handlers_do(bContext*, wmEvent*, ListBase*) (/home/guest/blender/build_master_lite/bin/blender+0x200584d)
    - 29 0x200f49f in wm_event_do_handlers (/home/guest/blender/build_master_lite/bin/blender+0x200f49f)

previously allocated by thread T0 here:
    - 0 0x7f3a2b6b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    - 1 0xa4ed87c in MEM_lockfree_mallocN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:264
    - 2 0xa4edc07 in MEM_lockfree_malloc_arrayN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:300
    - 3 0x14e8bae in layerCopy_mdeformvert(void const*, void*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8bae)
    - 4 0x1503d85 in customData_add_layer__internal(CustomData*, int, eCDAllocType, void*, int, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1503d85)
    - 5 0x14fbfef in CustomData_merge (/home/guest/blender/build_master_lite/bin/blender+0x14fbfef)
    - 6 0x14fda53 in CustomData_copy (/home/guest/blender/build_master_lite/bin/blender+0x14fda53)
    - 7 0x8fce3e in mesh_copy_data(Main*, ID*, ID const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x8fce3e)
    - 8 0x7e5b9b in BKE_id_copy_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id.c:636
    - 9 0x835799 in BKE_lib_override_library_update.localalias (/home/guest/blender/build_master_lite/bin/blender+0x835799)
    - 10 0x8377f9 in BKE_lib_override_library_main_update (/home/guest/blender/build_master_lite/bin/blender+0x8377f9)
    - 11 0x21858e7 in blo_read_file_internal /home/guest/blender/src/source/blender/blenloader/intern/readfile.c:3990
    - 12 0x235c9b9 in BLO_read_from_file /home/guest/blender/src/source/blender/blenloader/intern/readblenentry.c:364
    - 13 0x83b878a in BKE_blendfile_read /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:497
    - 14 0x202fd8f in WM_file_read /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:939
    - 15 0x203b928 in wm_file_read_opwrap /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2539
    - 16 0x203c925 in wm_open_mainfile__open /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2661
    - 17 0x203bca1 in operator_state_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2575
    - 18 0x203cb83 in wm_open_mainfile_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2685
    - 19 0x203bf5c in wm_open_mainfile__discard_changes /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2614
    - 20 0x203bca1 in operator_state_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2575
    - 21 0x203cb83 in wm_open_mainfile_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2685
    - 22 0x203cbac in wm_open_mainfile_invoke /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2690
    - 23 0x1ff22a3 in wm_operator_invoke(bContext*, wmOperatorType*, wmEvent const*, PointerRNA*, ReportList*, bool, bool) (/home/guest/blender/build_master_lite/bin/blender+0x1ff22a3)
    - 24 0x1ff4576 in wm_operator_call_internal(bContext*, wmOperatorType*, PointerRNA*, ReportList*, wmOperatorCallContext, bool, wmEvent const*) (/home/guest/blender/build_master_lite/bin/blender+0x1ff4576)
    - 25 0x1ff4676 in WM_operator_name_call_ptr (/home/guest/blender/build_master_lite/bin/blender+0x1ff4676)
    - 26 0x1ff5b89 in WM_operator_name_call_ptr_with_depends_on_cursor (/home/guest/blender/build_master_lite/bin/blender+0x1ff5b89)
    - 27 0x709df6e in ui_apply_but_funcs_after /home/guest/blender/src/source/blender/editors/interface/interface_handlers.c:1018
    - 28 0x712d264 in ui_popup_handler /home/guest/blender/src/source/blender/editors/interface/interface_handlers.c:11527
    - 29 0x1feb410 in wm_handler_ui_call(bContext*, wmEventHandler_UI*, wmEvent const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x1feb410)

Thread T22 created by T19 here:
    - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
    - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48)
    #2 0x60c00003603f  (<unknown module>)

Thread T19 created by T17 here:
    - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
    - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48)
    #2 0x60c00002bfbf  (<unknown module>)

Thread T17 created by T0 here:
    - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207
    - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48)
    #2 0x60c0000268bf  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
Shadow bytes around the buggy address:
  0x0c0682c00500: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c0682c00510: 04 fa fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa
  0x0c0682c00520: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa
  0x0c0682c00530: fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c0682c00540: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa
=>0x0c0682c00550: 00 00 00 fa fa fa 00[00]00 fa fa fa 00 00 04 fa
  0x0c0682c00560: fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa 00 00
  0x0c0682c00570: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa
  0x0c0682c00580: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 04 fa
  0x0c0682c00590: fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa 00 00
  0x0c0682c005a0: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1955045==ABORTING

With current master, any undo in some Heist production files (checked at least with `010_0020.anim.blend` `r1965`) crashes on invalid memory access in some mesh data. Cannot reproduce yet from scratch in simple files, still investigating what is exactly the issue. Caused by 05952aa94d. ASAN trace-back: ```lines=20 ==1955045==ERROR: AddressSanitizer: heap-use-after-free on address 0x603016042ab8 at pc 0x7f3a2b64814b bp 0x7f3a167b2c40 sp 0x7f3a167b23f0 READ of size 16 at 0x603016042ab8 thread T22 - 0 0x7f3a2b64814a in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 - 1 0x14e8cb4 in layerCopy_mdeformvert(void const*, void*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8cb4) - 2 0x1503d85 in customData_add_layer__internal(CustomData*, int, eCDAllocType, void*, int, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1503d85) - 3 0x14fbfef in CustomData_merge (/home/guest/blender/build_master_lite/bin/blender+0x14fbfef) - 4 0x14fda53 in CustomData_copy (/home/guest/blender/build_master_lite/bin/blender+0x14fda53) - 5 0x8fce3e in mesh_copy_data(Main*, ID*, ID const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x8fce3e) - 6 0x7e5b9b in BKE_id_copy_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id.c:636 - 7 0x2b8cd40 in blender::deg::(anonymous namespace)::id_copy_inplace_no_main(ID const*, ID*) (/home/guest/blender/build_master_lite/bin/blender+0x2b8cd40) - 8 0x2b90fb3 in blender::deg::(anonymous namespace)::deg_expand_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b90fb3) - 9 0x2b918d0 in blender::deg::deg_update_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b918d0) - 10 0x2b9271e in blender::deg::deg_evaluate_copy_on_write(Depsgraph*, blender::deg::IDNode const*) (/home/guest/blender/build_master_lite/bin/blender+0x2b9271e) - 11 0x2c11741 in blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}::operator()(Depsgraph*) const (/home/guest/blender/build_master_lite/bin/blender+0x2c11741) - 12 0x2c63b4c in void std::__invoke_impl<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>(std::__invoke_other, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c63b4c) - 13 0x2c5a6c4 in std::enable_if<is_invocable_r_v<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>, void>::type std::__invoke_r<void, blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*>(blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c5a6c4) - 14 0x2c54b6d in std::_Function_handler<void (Depsgraph*), blender::deg::DepsgraphNodeBuilder::add_id_node(ID*)::{lambda(Depsgraph*)#1}>::_M_invoke(std::_Any_data const&, Depsgraph*&&) (/home/guest/blender/build_master_lite/bin/blender+0x2c54b6d) - 15 0x2b896b0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const (/home/guest/blender/build_master_lite/bin/blender+0x2b896b0) - 16 0x2b840b2 in blender::deg::(anonymous namespace)::evaluate_node(blender::deg::(anonymous namespace)::DepsgraphEvalState const*, blender::deg::OperationNode*) (/home/guest/blender/build_master_lite/bin/blender+0x2b840b2) - 17 0x2b8437b in blender::deg::(anonymous namespace)::deg_task_run_func(TaskPool*, void*) (/home/guest/blender/build_master_lite/bin/blender+0x2b8437b) - 18 0xa4bef02 in Task::operator()() const (/home/guest/blender/build_master_lite/bin/blender+0xa4bef02) - 19 0xa4c3790 in tbb::internal::function_task<Task>::execute() (/home/guest/blender/build_master_lite/bin/blender+0xa4c3790) - 20 0x7f3a2be58ff4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/opt/lib/tbb/lib/libtbb.so+0x2cff4) - 21 0x7f3a2be59382 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/opt/lib/tbb/lib/libtbb.so+0x2d382) - 22 0x7f3a2be3efb6 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/opt/lib/tbb/lib/libtbb.so+0x12fb6) - 23 0x7f3a2be4e06f in tbb::internal::market::process(rml::job&) (/opt/lib/tbb/lib/libtbb.so+0x2206f) - 24 0x7f3a2be5205b in tbb::internal::rml::private_worker::run() (/opt/lib/tbb/lib/libtbb.so+0x2605b) - 25 0x7f3a2be52298 in tbb::internal::rml::private_worker::thread_routine(void*) (/opt/lib/tbb/lib/libtbb.so+0x26298) - 26 0x7f3a27c87b26 in start_thread nptl/pthread_create.c:435 - 27 0x7f3a27d0a78b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 0x603016042ab8 is located 8 bytes inside of 24-byte region [0x603016042ab0,0x603016042ac8) freed by thread T0 here: - 0 0x7f3a2b6b76a8 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:52 - 1 0xa4ece12 in MEM_lockfree_freeN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:117 - 2 0x14e8eb7 in layerFree_mdeformvert(void*, int, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8eb7) - 3 0x14fe16e in customData_free_layer__internal(CustomDataLayer*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14fe16e) - 4 0x14fe545 in CustomData_free (/home/guest/blender/build_master_lite/bin/blender+0x14fe545) - 5 0x90b852 in mesh_clear_geometry(Mesh*) (/home/guest/blender/build_master_lite/bin/blender+0x90b852) - 6 0x8fde45 in mesh_free_data(ID*) (/home/guest/blender/build_master_lite/bin/blender+0x8fde45) - 7 0x7f54df in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:73 - 8 0x7f5a3f in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:132 - 9 0x8639e2 in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:61 - 10 0x49cc32 in BKE_blender_globals_clear /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:164 - 11 0x83b6b27 in setup_app_data /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:291 - 12 0x83b8225 in setup_app_blend_file_data /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:446 - 13 0x83b8642 in BKE_blendfile_read_setup_ex /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:476 - 14 0x83b868d in BKE_blendfile_read_setup /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:485 - 15 0x83b3f74 in BKE_memfile_undo_decode /home/guest/blender/src/source/blender/blenkernel/intern/blender_undo.c:83 - 16 0x70073fd in memfile_undosys_step_decode /home/guest/blender/src/source/blender/editors/undo/memfile_undo.c:210 - 17 0x873506f in undosys_step_decode /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:200 - 18 0x873b4c9 in BKE_undosys_step_load_data_ex /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:780 - 19 0x873b964 in BKE_undosys_step_undo_with_data_ex /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:826 - 20 0x873b993 in BKE_undosys_step_undo_with_data /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:831 - 21 0x873bad5 in BKE_undosys_step_undo /home/guest/blender/src/source/blender/blenkernel/intern/undo_system.c:837 - 22 0x6fff2b9 in ed_undo_step_direction /home/guest/blender/src/source/blender/editors/undo/ed_undo.c:287 - 23 0x7000f2a in ed_undo_exec /home/guest/blender/src/source/blender/editors/undo/ed_undo.c:503 - 24 0x1ff290c in wm_operator_invoke(bContext*, wmOperatorType*, wmEvent const*, PointerRNA*, ReportList*, bool, bool) (/home/guest/blender/build_master_lite/bin/blender+0x1ff290c) - 25 0x1ffcbf0 in wm_handler_operator_call(bContext*, ListBase*, wmEventHandler*, wmEvent*, PointerRNA*, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1ffcbf0) - 26 0x200115d in wm_handlers_do_keymap_with_keymap_handler(bContext*, wmEvent*, ListBase*, wmEventHandler_Keymap*, wmKeyMap*, bool) (/home/guest/blender/build_master_lite/bin/blender+0x200115d) - 27 0x200443b in wm_handlers_do_intern(bContext*, wmWindow*, wmEvent*, ListBase*) (/home/guest/blender/build_master_lite/bin/blender+0x200443b) - 28 0x200584d in wm_handlers_do(bContext*, wmEvent*, ListBase*) (/home/guest/blender/build_master_lite/bin/blender+0x200584d) - 29 0x200f49f in wm_event_do_handlers (/home/guest/blender/build_master_lite/bin/blender+0x200f49f) previously allocated by thread T0 here: - 0 0x7f3a2b6b89cf in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 - 1 0xa4ed87c in MEM_lockfree_mallocN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:264 - 2 0xa4edc07 in MEM_lockfree_malloc_arrayN /home/guest/blender/src/intern/guardedalloc/intern/mallocn_lockfree_impl.c:300 - 3 0x14e8bae in layerCopy_mdeformvert(void const*, void*, int) (/home/guest/blender/build_master_lite/bin/blender+0x14e8bae) - 4 0x1503d85 in customData_add_layer__internal(CustomData*, int, eCDAllocType, void*, int, char const*) (/home/guest/blender/build_master_lite/bin/blender+0x1503d85) - 5 0x14fbfef in CustomData_merge (/home/guest/blender/build_master_lite/bin/blender+0x14fbfef) - 6 0x14fda53 in CustomData_copy (/home/guest/blender/build_master_lite/bin/blender+0x14fda53) - 7 0x8fce3e in mesh_copy_data(Main*, ID*, ID const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x8fce3e) - 8 0x7e5b9b in BKE_id_copy_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id.c:636 - 9 0x835799 in BKE_lib_override_library_update.localalias (/home/guest/blender/build_master_lite/bin/blender+0x835799) - 10 0x8377f9 in BKE_lib_override_library_main_update (/home/guest/blender/build_master_lite/bin/blender+0x8377f9) - 11 0x21858e7 in blo_read_file_internal /home/guest/blender/src/source/blender/blenloader/intern/readfile.c:3990 - 12 0x235c9b9 in BLO_read_from_file /home/guest/blender/src/source/blender/blenloader/intern/readblenentry.c:364 - 13 0x83b878a in BKE_blendfile_read /home/guest/blender/src/source/blender/blenkernel/intern/blendfile.c:497 - 14 0x202fd8f in WM_file_read /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:939 - 15 0x203b928 in wm_file_read_opwrap /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2539 - 16 0x203c925 in wm_open_mainfile__open /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2661 - 17 0x203bca1 in operator_state_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2575 - 18 0x203cb83 in wm_open_mainfile_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2685 - 19 0x203bf5c in wm_open_mainfile__discard_changes /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2614 - 20 0x203bca1 in operator_state_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2575 - 21 0x203cb83 in wm_open_mainfile_dispatch /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2685 - 22 0x203cbac in wm_open_mainfile_invoke /home/guest/blender/src/source/blender/windowmanager/intern/wm_files.c:2690 - 23 0x1ff22a3 in wm_operator_invoke(bContext*, wmOperatorType*, wmEvent const*, PointerRNA*, ReportList*, bool, bool) (/home/guest/blender/build_master_lite/bin/blender+0x1ff22a3) - 24 0x1ff4576 in wm_operator_call_internal(bContext*, wmOperatorType*, PointerRNA*, ReportList*, wmOperatorCallContext, bool, wmEvent const*) (/home/guest/blender/build_master_lite/bin/blender+0x1ff4576) - 25 0x1ff4676 in WM_operator_name_call_ptr (/home/guest/blender/build_master_lite/bin/blender+0x1ff4676) - 26 0x1ff5b89 in WM_operator_name_call_ptr_with_depends_on_cursor (/home/guest/blender/build_master_lite/bin/blender+0x1ff5b89) - 27 0x709df6e in ui_apply_but_funcs_after /home/guest/blender/src/source/blender/editors/interface/interface_handlers.c:1018 - 28 0x712d264 in ui_popup_handler /home/guest/blender/src/source/blender/editors/interface/interface_handlers.c:11527 - 29 0x1feb410 in wm_handler_ui_call(bContext*, wmEventHandler_UI*, wmEvent const*, int) (/home/guest/blender/build_master_lite/bin/blender+0x1feb410) Thread T22 created by T19 here: - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207 - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48) #2 0x60c00003603f (<unknown module>) Thread T19 created by T17 here: - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207 - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48) #2 0x60c00002bfbf (<unknown module>) Thread T17 created by T0 here: - 0 0x7f3a2b649726 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cpp:207 - 1 0x7f3a2be51f48 in tbb::internal::rml::private_server::wake_some(int) (/opt/lib/tbb/lib/libtbb.so+0x25f48) #2 0x60c0000268bf (<unknown module>) SUMMARY: AddressSanitizer: heap-use-after-free ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy Shadow bytes around the buggy address: 0x0c0682c00500: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 0x0c0682c00510: 04 fa fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa 0x0c0682c00520: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 00 fa 0x0c0682c00530: fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa 00 00 0x0c0682c00540: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa =>0x0c0682c00550: 00 00 00 fa fa fa 00[00]00 fa fa fa 00 00 04 fa 0x0c0682c00560: fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa 00 00 0x0c0682c00570: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa 0x0c0682c00580: 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 04 fa 0x0c0682c00590: fa fa 00 00 00 fa fa fa 00 00 04 fa fa fa 00 00 0x0c0682c005a0: 00 fa fa fa 00 00 04 fa fa fa 00 00 00 fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1955045==ABORTING ```

Bastien Montagne commented

2022-09-07 13:09:11 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'