Cycles shader compilation can cause double-free in OpenImageIO #105955

New Issue

Sybren A. Stüvel · 2023-03-21T14:56:57+01:00

Sybren A. Stüvel commented

2023-03-21 14:56:57 +01:00

System Information
Operating system: Ubuntu Linux 22.04.2 LTS

Blender Version
Broken: 3.5 & 3.6 main branch, 5316cdb26d3b5e71a8086128808d0650798ac4e4
Worked: unsure

Short description of error
Cycles shader compilation can cause a double-free of a hashmap in OpenImageIO. It seems to be an OIIO-internal map related to ICC profiles.

Exact steps for others to reproduce the error

Unfortunately this example needs access to the Blender Studio render farm.

With an ASAN-enabled debug build of Blender, run:

rm /tmp/abyss-000063.png
blender "--factory-startup" "-b" "-y" "--python-expr" "import bpy; bpy.context.preferences.system.use_gpu_subdivision=False" "/render/_flamenco/flamenco3-storage/jobs/abyss-u8ak/abyss.flamenco.blend" "--render-output" "/tmp/abyss-######" "--render-format" "PNG" "--render-frame" "63"

The ASAN report:

=================================================================
==135324==ERROR: AddressSanitizer: attempting double-free on 0x60b000058670 in thread T66:
    #0 0xb98f32 in free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f877b5dd2f7 in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_rehash(unsigned long, unsigned long const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x4242f7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #2 0x7f877b5dd40f in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_insert_unique_node(unsigned long, unsigned long, std::__detail::_Hash_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, true>*, unsigned long) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x42440f) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #3 0x7f877b5dd513 in std::__detail::_Map_base<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true>, true>::operator[](std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x424513) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #4 0x7f877b5dbad7 in OpenImageIO_v2_4::decode_icc_profile(OpenImageIO_v2_4::span<unsigned char const, -1l>, OpenImageIO_v2_4::ImageSpec&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x422ad7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #5 0x7f877b6f3d3e in OpenImageIO_v2_4::PNG_pvt::read_info(png_struct_def*&, png_info_def*&, int&, int&, int&, Imath_3_1::Color3<float>&, OpenImageIO_v2_4::ImageSpec&, bool) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x53ad3e) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #6 0x7f877b7307c8 in OpenImageIO_v2_4::PNGInput::open(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO_v2_4::ImageSpec&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x5777c8) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)
    #7 0x223004bb in ccl::OIIOImageLoader::load_metadata(ccl::ImageDeviceFeatures const&, ccl::ImageMetaData&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image_oiio.cpp:41:12
    #8 0x222ae3b5 in ccl::ImageManager::load_image_metadata(ccl::ImageManager::Image*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image.cpp:375:20
    #9 0x222adb45 in ccl::ImageHandle::metadata() /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image.cpp:141:12
    #10 0x22b55632 in ccl::ImageTextureNode::compile(ccl::SVMCompiler&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/shader_nodes.cpp:367:41
    #11 0x22d98626 in ccl::SVMCompiler::generate_node(ccl::ShaderNode*, std::set<ccl::ShaderNode*, ccl::ShaderNodeIDComparator, std::allocator<ccl::ShaderNode*> >&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:432:9
    #12 0x22d9a4d8 in ccl::SVMCompiler::generate_svm_nodes(std::set<ccl::ShaderNode*, ccl::ShaderNodeIDComparator, std::allocator<ccl::ShaderNode*> > const&, ccl::SVMCompiler::CompilerState*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:473:11
    #13 0x22d9dc80 in ccl::SVMCompiler::generate_multi_closure(ccl::ShaderNode*, ccl::ShaderNode*, ccl::SVMCompiler::CompilerState*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:591:7
    #14 0x22da450e in ccl::SVMCompiler::compile_type(ccl::Shader*, ccl::ShaderGraph*, ccl::ShaderType) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:811:9
    #15 0x22d8b6bc in ccl::SVMCompiler::compile(ccl::Shader*, ccl::array<ccl::int4, 16ul>&, int, ccl::SVMCompiler::Summary*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:897:5
    #16 0x22d884c7 in ccl::SVMShaderManager::device_update_shader(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:50:12
    #17 0x22dad81f in void std::__invoke_impl<void, void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>(std::__invoke_memfun_deref, void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:74:14
    #18 0x22dacfd8 in std::__invoke_result<void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>::type std::__invoke<void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>(void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14
    #19 0x22dacd33 in void std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>::__call<void, 0ul, 1ul, 2ul, 3ul, 4ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul, 3ul, 4ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:484:11
    #20 0x22dac795 in void std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:567:17
    #21 0x22dac655 in void std::__invoke_impl<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>(std::__invoke_other, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14
    #22 0x22dac575 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>, void>::type std::__invoke_r<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>(std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:111:2
    #23 0x22dabd05 in std::_Function_handler<void (), std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:290:9
    #24 0x1402539 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:591:9
    #25 0x2929a644 in tbb::internal::function_task<std::function<void ()> >::execute() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059:13
    #26 0x7f877c7fdb44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x29b44) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564)
    #27 0x7f877c7fde77 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x29e77) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564)
    #28 0xc4bcf7b in tbb::task::wait_for_all() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:820:25
    #29 0xc4bb98e in tbb::internal::task_group_base::wait() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task_group.h:168:22
    #30 0x2929548f in ccl::TaskPool::wait_work(ccl::TaskPool::Summary*) /home/sybren/workspace/blender-git/blender/intern/cycles/util/task.cpp:31:13
    #31 0x22d8e518 in ccl::SVMShaderManager::device_update_specific(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:91:13
    #32 0x22a42a04 in ccl::ShaderManager::device_update(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/shader.cpp:480:3
    #33 0x229af4ba in ccl::Scene::device_update(ccl::Device*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/scene.cpp:265:19
    #34 0x229c0d64 in ccl::Scene::update(ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/scene.cpp:586:3
    #35 0x231960d7 in ccl::Session::update_scene(int, int) /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:672:17
    #36 0x23190f50 in ccl::Session::run_update_for_next_iteration() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:401:9
    #37 0x2318c17d in ccl::Session::run_main_render_loop() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:153:30
    #38 0x231937a5 in ccl::Session::thread_render() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:269:5
    #39 0x2318a3ba in ccl::Session::thread_run() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:236:5
    #40 0x231a323e in void std::__invoke_impl<void, void (ccl::Session::*&)(), ccl::Session*&>(std::__invoke_memfun_deref, void (ccl::Session::*&)(), ccl::Session*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:74:14
    #41 0x231a2ff6 in std::__invoke_result<void (ccl::Session::*&)(), ccl::Session*&>::type std::__invoke<void (ccl::Session::*&)(), ccl::Session*&>(void (ccl::Session::*&)(), ccl::Session*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14
    #42 0x231a2ee0 in void std::_Bind<void (ccl::Session::* (ccl::Session*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:484:11
    #43 0x231a2cd5 in void std::_Bind<void (ccl::Session::* (ccl::Session*))()>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:567:17
    #44 0x231a2b95 in void std::__invoke_impl<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>(std::__invoke_other, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14
    #45 0x231a2ab5 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>(std::_Bind<void (ccl::Session::* (ccl::Session*))()>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:111:2
    #46 0x231a2505 in std::_Function_handler<void (), std::_Bind<void (ccl::Session::* (ccl::Session*))()> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:290:9
    #47 0x1402539 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:591:9
    #48 0x2929db24 in ccl::thread::run(void*) /home/sybren/workspace/blender-git/blender/intern/cycles/util/thread.cpp:38:3
    #49 0x2929ed66 in void* std::__invoke_impl<void*, void* (*)(void*), ccl::thread*>(std::__invoke_other, void* (*&&)(void*), ccl::thread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14
    #50 0x2929eaa6 in std::__invoke_result<void* (*)(void*), ccl::thread*>::type std::__invoke<void* (*)(void*), ccl::thread*>(void* (*&&)(void*), ccl::thread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14
    #51 0x2929e9e2 in void* std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:252:13
    #52 0x2929e8c6 in std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:259:11
    #53 0x2929e4c4 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> > >::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:210:13
    #54 0x7f8774f3e2b2  (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc2b2) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea)
    #55 0x7f877c640b42 in start_thread nptl/./nptl/pthread_create.c:442:8
    #56 0x7f877c6d29ff  misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

0x60b000058670 is located 0 bytes inside of 104-byte region [0x60b000058670,0x60b0000586d8)
freed by thread T48 here:
    #0 0xb98f32 in free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f877b5dd2f7 in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_rehash(unsigned long, unsigned long const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x4242f7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc)

previously allocated by thread T66 here:
    #0 0xb991de in malloc (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb991de) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f8774f109cb in operator new(unsigned long) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xae9cb) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea)

Thread T66 created by T0 here:
    #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f8774f3e388 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc388) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea)
    #2 0x2929d965 in ccl::thread::thread(std::function<void ()>) /home/sybren/workspace/blender-git/blender/intern/cycles/util/thread.cpp:24:16
    #3 0x2318991f in ccl::Session::Session(ccl::SessionParams const&, ccl::SceneParams const&) /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:66:25
    #4 0x12ef2051 in ccl::BlenderSession::create_session() /home/sybren/workspace/blender-git/blender/intern/cycles/blender/session.cpp:125:17
    #5 0x12ef4711 in ccl::BlenderSession::reset_session(BL::BlendData&, BL::Depsgraph&) /home/sybren/workspace/blender-git/blender/intern/cycles/blender/session.cpp:189:5
    #6 0x12e96d98 in ccl::reset_func(_object*, _object*) /home/sybren/workspace/blender-git/blender/intern/cycles/blender/python.cpp:366:12
    #7 0xa946ef in cfunction_call /src/build_linux/deps/build/python/src/external_python/Objects/methodobject.c:552:18

Thread T48 created by T35 here:
    #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f877c7f8488 in tbb::internal::rml::private_server::wake_some(int) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x24488) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564)
    #2 0x60c00005013f  (<unknown module>)

Thread T35 created by T0 here:
    #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc)
    #1 0x7f877c7f8488 in tbb::internal::rml::private_server::wake_some(int) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x24488) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564)
    #2 0x60c00004e9ff  (<unknown module>)

SUMMARY: AddressSanitizer: double-free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) in free
==135324==ABORTING

**System Information** Operating system: Ubuntu Linux 22.04.2 LTS **Blender Version** Broken: 3.5 & 3.6 main branch, `5316cdb26d3b5e71a8086128808d0650798ac4e4` Worked: unsure **Short description of error** Cycles shader compilation can cause a double-free of a hashmap in OpenImageIO. It seems to be an OIIO-internal map related to ICC profiles. **Exact steps for others to reproduce the error** Unfortunately this example needs access to the Blender Studio render farm. With an ASAN-enabled debug build of Blender, run: ``` rm /tmp/abyss-000063.png blender "--factory-startup" "-b" "-y" "--python-expr" "import bpy; bpy.context.preferences.system.use_gpu_subdivision=False" "/render/_flamenco/flamenco3-storage/jobs/abyss-u8ak/abyss.flamenco.blend" "--render-output" "/tmp/abyss-######" "--render-format" "PNG" "--render-frame" "63" ``` The ASAN report: ``` ================================================================= ==135324==ERROR: AddressSanitizer: attempting double-free on 0x60b000058670 in thread T66: #0 0xb98f32 in free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f877b5dd2f7 in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_rehash(unsigned long, unsigned long const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x4242f7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #2 0x7f877b5dd40f in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_insert_unique_node(unsigned long, unsigned long, std::__detail::_Hash_node<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, true>*, unsigned long) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x42440f) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #3 0x7f877b5dd513 in std::__detail::_Map_base<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true>, true>::operator[](std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x424513) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #4 0x7f877b5dbad7 in OpenImageIO_v2_4::decode_icc_profile(OpenImageIO_v2_4::span<unsigned char const, -1l>, OpenImageIO_v2_4::ImageSpec&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x422ad7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #5 0x7f877b6f3d3e in OpenImageIO_v2_4::PNG_pvt::read_info(png_struct_def*&, png_info_def*&, int&, int&, int&, Imath_3_1::Color3<float>&, OpenImageIO_v2_4::ImageSpec&, bool) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x53ad3e) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #6 0x7f877b7307c8 in OpenImageIO_v2_4::PNGInput::open(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, OpenImageIO_v2_4::ImageSpec&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x5777c8) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) #7 0x223004bb in ccl::OIIOImageLoader::load_metadata(ccl::ImageDeviceFeatures const&, ccl::ImageMetaData&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image_oiio.cpp:41:12 #8 0x222ae3b5 in ccl::ImageManager::load_image_metadata(ccl::ImageManager::Image*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image.cpp:375:20 #9 0x222adb45 in ccl::ImageHandle::metadata() /home/sybren/workspace/blender-git/blender/intern/cycles/scene/image.cpp:141:12 #10 0x22b55632 in ccl::ImageTextureNode::compile(ccl::SVMCompiler&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/shader_nodes.cpp:367:41 #11 0x22d98626 in ccl::SVMCompiler::generate_node(ccl::ShaderNode*, std::set<ccl::ShaderNode*, ccl::ShaderNodeIDComparator, std::allocator<ccl::ShaderNode*> >&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:432:9 #12 0x22d9a4d8 in ccl::SVMCompiler::generate_svm_nodes(std::set<ccl::ShaderNode*, ccl::ShaderNodeIDComparator, std::allocator<ccl::ShaderNode*> > const&, ccl::SVMCompiler::CompilerState*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:473:11 #13 0x22d9dc80 in ccl::SVMCompiler::generate_multi_closure(ccl::ShaderNode*, ccl::ShaderNode*, ccl::SVMCompiler::CompilerState*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:591:7 #14 0x22da450e in ccl::SVMCompiler::compile_type(ccl::Shader*, ccl::ShaderGraph*, ccl::ShaderType) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:811:9 #15 0x22d8b6bc in ccl::SVMCompiler::compile(ccl::Shader*, ccl::array<ccl::int4, 16ul>&, int, ccl::SVMCompiler::Summary*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:897:5 #16 0x22d884c7 in ccl::SVMShaderManager::device_update_shader(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:50:12 #17 0x22dad81f in void std::__invoke_impl<void, void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>(std::__invoke_memfun_deref, void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:74:14 #18 0x22dacfd8 in std::__invoke_result<void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>::type std::__invoke<void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&>(void (ccl::SVMShaderManager::*&)(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*), ccl::SVMShaderManager*&, ccl::Scene*&, ccl::Shader*&, ccl::Progress*&, ccl::array<ccl::int4, 16ul>*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14 #19 0x22dacd33 in void std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>::__call<void, 0ul, 1ul, 2ul, 3ul, 4ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul, 2ul, 3ul, 4ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:484:11 #20 0x22dac795 in void std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:567:17 #21 0x22dac655 in void std::__invoke_impl<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>(std::__invoke_other, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14 #22 0x22dac575 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>, void>::type std::__invoke_r<void, std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&>(std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:111:2 #23 0x22dabd05 in std::_Function_handler<void (), std::_Bind<void (ccl::SVMShaderManager::* (ccl::SVMShaderManager*, ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*))(ccl::Scene*, ccl::Shader*, ccl::Progress*, ccl::array<ccl::int4, 16ul>*)> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:290:9 #24 0x1402539 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:591:9 #25 0x2929a644 in tbb::internal::function_task<std::function<void ()> >::execute() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059:13 #26 0x7f877c7fdb44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x29b44) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564) #27 0x7f877c7fde77 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x29e77) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564) #28 0xc4bcf7b in tbb::task::wait_for_all() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:820:25 #29 0xc4bb98e in tbb::internal::task_group_base::wait() /home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/include/tbb/task_group.h:168:22 #30 0x2929548f in ccl::TaskPool::wait_work(ccl::TaskPool::Summary*) /home/sybren/workspace/blender-git/blender/intern/cycles/util/task.cpp:31:13 #31 0x22d8e518 in ccl::SVMShaderManager::device_update_specific(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/svm.cpp:91:13 #32 0x22a42a04 in ccl::ShaderManager::device_update(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/shader.cpp:480:3 #33 0x229af4ba in ccl::Scene::device_update(ccl::Device*, ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/scene.cpp:265:19 #34 0x229c0d64 in ccl::Scene::update(ccl::Progress&) /home/sybren/workspace/blender-git/blender/intern/cycles/scene/scene.cpp:586:3 #35 0x231960d7 in ccl::Session::update_scene(int, int) /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:672:17 #36 0x23190f50 in ccl::Session::run_update_for_next_iteration() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:401:9 #37 0x2318c17d in ccl::Session::run_main_render_loop() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:153:30 #38 0x231937a5 in ccl::Session::thread_render() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:269:5 #39 0x2318a3ba in ccl::Session::thread_run() /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:236:5 #40 0x231a323e in void std::__invoke_impl<void, void (ccl::Session::*&)(), ccl::Session*&>(std::__invoke_memfun_deref, void (ccl::Session::*&)(), ccl::Session*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:74:14 #41 0x231a2ff6 in std::__invoke_result<void (ccl::Session::*&)(), ccl::Session*&>::type std::__invoke<void (ccl::Session::*&)(), ccl::Session*&>(void (ccl::Session::*&)(), ccl::Session*&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14 #42 0x231a2ee0 in void std::_Bind<void (ccl::Session::* (ccl::Session*))()>::__call<void, 0ul>(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:484:11 #43 0x231a2cd5 in void std::_Bind<void (ccl::Session::* (ccl::Session*))()>::operator()<void>() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/functional:567:17 #44 0x231a2b95 in void std::__invoke_impl<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>(std::__invoke_other, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14 #45 0x231a2ab5 in std::enable_if<is_invocable_r_v<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>, void>::type std::__invoke_r<void, std::_Bind<void (ccl::Session::* (ccl::Session*))()>&>(std::_Bind<void (ccl::Session::* (ccl::Session*))()>&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:111:2 #46 0x231a2505 in std::_Function_handler<void (), std::_Bind<void (ccl::Session::* (ccl::Session*))()> >::_M_invoke(std::_Any_data const&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:290:9 #47 0x1402539 in std::function<void ()>::operator()() const /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_function.h:591:9 #48 0x2929db24 in ccl::thread::run(void*) /home/sybren/workspace/blender-git/blender/intern/cycles/util/thread.cpp:38:3 #49 0x2929ed66 in void* std::__invoke_impl<void*, void* (*)(void*), ccl::thread*>(std::__invoke_other, void* (*&&)(void*), ccl::thread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:61:14 #50 0x2929eaa6 in std::__invoke_result<void* (*)(void*), ccl::thread*>::type std::__invoke<void* (*)(void*), ccl::thread*>(void* (*&&)(void*), ccl::thread*&&) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/invoke.h:96:14 #51 0x2929e9e2 in void* std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:252:13 #52 0x2929e8c6 in std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> >::operator()() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:259:11 #53 0x2929e4c4 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void* (*)(void*), ccl::thread*> > >::_M_run() /usr/bin/../lib/gcc/x86_64-linux-gnu/12/../../../../include/c++/12/bits/std_thread.h:210:13 #54 0x7f8774f3e2b2 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc2b2) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea) #55 0x7f877c640b42 in start_thread nptl/./nptl/pthread_create.c:442:8 #56 0x7f877c6d29ff misc/../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 0x60b000058670 is located 0 bytes inside of 104-byte region [0x60b000058670,0x60b0000586d8) freed by thread T48 here: #0 0xb98f32 in free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f877b5dd2f7 in std::_Hashtable<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_rehash(unsigned long, unsigned long const&) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/openimageio/lib/libOpenImageIO.so.2.4+0x4242f7) (BuildId: 11b043bbf675816036fd698076b36f572b9a53dc) previously allocated by thread T66 here: #0 0xb991de in malloc (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb991de) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f8774f109cb in operator new(unsigned long) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xae9cb) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea) Thread T66 created by T0 here: #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f8774f3e388 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) (/lib/x86_64-linux-gnu/libstdc++.so.6+0xdc388) (BuildId: f57e02bfadacc0c923c82457d5e18e1830b5faea) #2 0x2929d965 in ccl::thread::thread(std::function<void ()>) /home/sybren/workspace/blender-git/blender/intern/cycles/util/thread.cpp:24:16 #3 0x2318991f in ccl::Session::Session(ccl::SessionParams const&, ccl::SceneParams const&) /home/sybren/workspace/blender-git/blender/intern/cycles/session/session.cpp:66:25 #4 0x12ef2051 in ccl::BlenderSession::create_session() /home/sybren/workspace/blender-git/blender/intern/cycles/blender/session.cpp:125:17 #5 0x12ef4711 in ccl::BlenderSession::reset_session(BL::BlendData&, BL::Depsgraph&) /home/sybren/workspace/blender-git/blender/intern/cycles/blender/session.cpp:189:5 #6 0x12e96d98 in ccl::reset_func(_object*, _object*) /home/sybren/workspace/blender-git/blender/intern/cycles/blender/python.cpp:366:12 #7 0xa946ef in cfunction_call /src/build_linux/deps/build/python/src/external_python/Objects/methodobject.c:552:18 Thread T48 created by T35 here: #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f877c7f8488 in tbb::internal::rml::private_server::wake_some(int) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x24488) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564) #2 0x60c00005013f (<unknown module>) Thread T35 created by T0 here: #0 0xb8265c in pthread_create (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb8265c) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) #1 0x7f877c7f8488 in tbb::internal::rml::private_server::wake_some(int) (/home/sybren/workspace/blender-git/lib/linux_x86_64_glibc_228/tbb/lib/libtbb.so+0x24488) (BuildId: ed265b02a12697fcafde760af3b4a3f27d857564) #2 0x60c00004e9ff (<unknown module>) SUMMARY: AddressSanitizer: double-free (/home/sybren/workspace/blender-git/build_debug/bin/blender+0xb98f32) (BuildId: 389871d3fdc10210991a0b98db0c6a65162391bc) in free ==135324==ABORTING ```

Sybren A. Stüvel added the

labels 2023-03-21 14:56:57 +01:00

Brecht Van Lommel commented

2023-03-21 15:24:26 +01:00

Looks like this was fixed in OpenImageIO, and we'll need to upgrade:
https://github.com/OpenImageIO/oiio/pull/3767

Looks like this was fixed in OpenImageIO, and we'll need to upgrade: https://github.com/OpenImageIO/oiio/pull/3767