Compositor ACCESS VIOLATION when updating datablocks from handlers #107248

Closed
opened 2023-04-22 18:09:57 +02:00 by Julieta Riley · 11 comments

System Information
Operating system: Windows-10-10.0.19044-SP0 64 Bits
Graphics card: NVIDIA GeForce GTX 1070/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 526.98

Blender Version
Broken: version: 3.5.1 Release Candidate, branch: blender-v3.5-release, commit date: 2023-04-05 07:29, hash: 8f3faae18b
Worked: (newest version of Blender that worked as expected)

Short description of error

re-created because #102234 was closed before fixed.
provided blend is as small as simplified as possible without losing the problem. Supplied addon was already reduced from 8000 lines of code.

Access violation during playback in full frame compositor mode if datablocks updated from frame change handler.

Exact steps for others to reproduce the error
Hi, some of our in house tools appear to not work with the full frame compositor. Please use the massively cut down demo addon and scene file below:
https://archive.blender.org/developer/F13841850/full_frame_bug_demo_addon.zip
https://archive.blender.org/developer/F13841851/full_frame_bug_scene_and_assetts.zip
https://archive.blender.org/developer/F13842038/compositor_bug_original.crash.txt

Steps:

Open Blender 3.4
Turn on the Full Frame compositor in the experimental section of the preferences.
unzip the 'full frame bug scene and assetts' file.
Open the enclosed .blend file (with load UI enabled).
Go to Scene.002 if it's not already there.
In the compositor options make sure mode is set to tiled.
Press right arrow once to refresh the compositor backdrop. It should show the monkeys.
Press spacebar to play the timeline (The image datablocks will be updated each frame based on the active timeline camera markers of both scenes.)
Stop playback
Switch to Full Frame Compositor mode in the compositor's options
Press the spacebar again to recommence playback. It usually crashes immediately.
If it doesn't crash immediately, stop and start playback a few times, switch to the other scene playback there then swap back to scene.002, try swapping modes and playing back a few times, or try reopening the file or re-installing the demo addon. Once it does crash, re-opening the file will often cause tiled rendering to also crash next time blender is opened. After a closing down blender and re-opening a few times, Tiled mode will become stable once more, saving the file after successfully getting tiled mode working again usually resolves permanently until the next time Full Frame mode is attempted.

The crash always happens on line 56 of scene_helpers.py when the image datablocks filepath is given the new string. I've added print statements either side to demonstrate this. After the initial access violation, it will sometimes manage a few more lines of code before finally crashing completely.

Although render.render is called on line 70 of the scene_helpers , this doesn't appear to be related, as the issue happens even when that line is commented out. Also the handler has checks to ensure it's only executed once per frame and not when render.render instigates another call to the frame change handler. Additionally the viewport is locked during rendering as advised in the handlers section of the python API.

System Information Operating system: Windows-10-10.0.19044-SP0 64 Bits Graphics card: NVIDIA GeForce GTX 1070/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 526.98 Blender Version Broken: version: 3.5.1 Release Candidate, branch: blender-v3.5-release, commit date: 2023-04-05 07:29, hash: 8f3faae18bb8 Worked: (newest version of Blender that worked as expected) Short description of error re-created because https://projects.blender.org/blender/blender/issues/102234 was closed before fixed. provided blend is as small as simplified as possible without losing the problem. Supplied addon was already reduced from 8000 lines of code. Access violation during playback in full frame compositor mode if datablocks updated from frame change handler. Exact steps for others to reproduce the error Hi, some of our in house tools appear to not work with the full frame compositor. Please use the massively cut down demo addon and scene file below: https://archive.blender.org/developer/F13841850/full_frame_bug_demo_addon.zip https://archive.blender.org/developer/F13841851/full_frame_bug_scene_and_assetts.zip https://archive.blender.org/developer/F13842038/compositor_bug_original.crash.txt Steps: Open Blender 3.4 Turn on the Full Frame compositor in the experimental section of the preferences. unzip the 'full frame bug scene and assetts' file. Open the enclosed .blend file (with load UI enabled). Go to Scene.002 if it's not already there. In the compositor options make sure mode is set to tiled. Press right arrow once to refresh the compositor backdrop. It should show the monkeys. Press spacebar to play the timeline (The image datablocks will be updated each frame based on the active timeline camera markers of both scenes.) Stop playback Switch to Full Frame Compositor mode in the compositor's options Press the spacebar again to recommence playback. It usually crashes immediately. If it doesn't crash immediately, stop and start playback a few times, switch to the other scene playback there then swap back to scene.002, try swapping modes and playing back a few times, or try reopening the file or re-installing the demo addon. Once it does crash, re-opening the file will often cause tiled rendering to also crash next time blender is opened. After a closing down blender and re-opening a few times, Tiled mode will become stable once more, saving the file after successfully getting tiled mode working again usually resolves permanently until the next time Full Frame mode is attempted. The crash always happens on line 56 of scene_helpers.py when the image datablocks filepath is given the new string. I've added print statements either side to demonstrate this. After the initial access violation, it will sometimes manage a few more lines of code before finally crashing completely. Although render.render is called on line 70 of the scene_helpers , this doesn't appear to be related, as the issue happens even when that line is commented out. Also the handler has checks to ensure it's only executed once per frame and not when render.render instigates another call to the frame change handler. Additionally the viewport is locked during rendering as advised in the handlers section of the python API.
Julieta Riley added the
Priority
Normal
Type
Report
Status
Needs Triage
labels 2023-04-22 18:09:58 +02:00
Iliya Katushenock added the
Interest
Compositing
Interest
Nodes & Physics
labels 2023-04-22 18:28:22 +02:00
Member

Similar to #107235 .

Similar to #107235 .
Member

Can confirm this.
Note: I can even repro with Tiled.

This is what ASAN has to say:

==67998==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f1429b5aa78 at pc 0x000005438b9c bp 0x7f1418eb8230 sp 0x7f1418eb8228
READ of size 4 at 0x7f1429b5aa78 thread T139
    #0 0x5438b9b in copy_v4_v4 /blender/source/blender/blenlib/intern/math_vector_inline.c:58
    #1 0x543ee90 in nearest_interpolation_color_fl /blender/source/blender/imbuf/intern/imageprocess.c:274
    #2 0x543eee4 in nearest_interpolation_color /blender/source/blender/imbuf/intern/imageprocess.c:281
    #3 0x6d52d4b in blender::compositor::MultilayerColorOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_MultilayerImageOperation.cc:83
    #4 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574)
    #5 0x6fa6ac3 in blender::compositor::SetAlphaReplaceOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_SetAlphaReplaceOperation.cc:32
    #6 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574)
    #7 0x6c9500f in blender::compositor::MixBlendOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_MixOperation.cc:181
    #8 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574)
    #9 0x6d1c1a7 in blender::compositor::ViewerOperation::execute_region(rcti*, unsigned int) /blender/source/blender/compositor/operations/COM_ViewerOperation.cc:83
    #10 0x6b17d7f in blender::compositor::CPUDevice::execute(blender::compositor::WorkPackage*) /blender/source/blender/compositor/intern/COM_CPUDevice.cc:20
    #11 0x6a65796 in threading_model_queue_execute /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:308
    #12 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176
    #13 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c)
    #14 0x7f148c72fbbf in __clone3 (/lib64/libc.so.6+0x10cbbf)

0x7f1429b5aa78 is located 3146360 bytes inside of 33177608-byte region [0x7f142985a800,0x7f142b7fe808)
freed by thread T0 here:
    #0 0x7f14940b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388)
    #1 0x1ff74f10 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:102
    #2 0xa72a6d8 in render_result_free /blender/source/blender/render/intern/render_result.cc:83
    #3 0xa705f1c in RE_FreeRenderResult /blender/source/blender/render/intern/pipeline.cc:225
    #4 0xc1c617 in BKE_image_free_buffers_ex /blender/source/blender/blenkernel/intern/image.cc:615
    #5 0xc1c741 in BKE_image_free_buffers /blender/source/blender/blenkernel/intern/image.cc:628
    #6 0xc38ee6 in BKE_image_signal /blender/source/blender/blenkernel/intern/image.cc:3168
    #7 0x5e7d791 in rna_Image_reload_update /blender/source/blender/makesrna/intern/rna_image.c:102
    #8 0x5bb57ec in rna_property_update /blender/source/blender/makesrna/intern/rna_access.cc:2103
    #9 0x5bb6072 in RNA_property_update /blender/source/blender/makesrna/intern/rna_access.cc:2172
    #10 0x67a0806 in pyrna_py_to_prop /blender/source/blender/python/intern/bpy_rna.c:2088
    #11 0x67b23f3 in pyrna_struct_setattro /blender/source/blender/python/intern/bpy_rna.c:4591
    #12 0x8c0f83 in PyObject_SetAttr Objects/object.c:1044

previously allocated by thread T74 here:
    #0 0x7f14940ba097 in calloc (/lib64/libasan.so.8+0xba097)
    #1 0x1ff75645 in MEM_lockfree_callocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:208
    #2 0x1ddc7bcc in imb_exr_multilayer_parse_channels_from_file /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:1672
    #3 0x1ddca04c in imb_exr_begin_read_mem /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:1746
    #4 0x1ddceb07 in imb_load_openexr /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:2063
    #5 0x5474058 in IMB_ibImageFromMemory /blender/source/blender/imbuf/intern/readimage.c:102
    #6 0x54742c6 in IMB_loadifffile /blender/source/blender/imbuf/intern/readimage.c:139
    #7 0x54743c0 in IMB_loadiffname /blender/source/blender/imbuf/intern/readimage.c:160
    #8 0xc43d05 in load_image_single /blender/source/blender/blenkernel/intern/image.cc:4151
    #9 0xc44902 in image_load_image_file /blender/source/blender/blenkernel/intern/image.cc:4220
    #10 0xc4533a in image_get_ibuf_multilayer /blender/source/blender/blenkernel/intern/image.cc:4270
    #11 0xc4a39d in image_acquire_ibuf /blender/source/blender/blenkernel/intern/image.cc:4683
    #12 0xc4ae6e in BKE_image_acquire_ibuf /blender/source/blender/blenkernel/intern/image.cc:4753
    #13 0x6a1b1ac in blender::compositor::ImageNode::convert_to_operations(blender::compositor::NodeConverter&, blender::compositor::CompositorContext const&) const /blender/source/blender/compositor/nodes/COM_ImageNode.cc:67
    #14 0x6a46301 in blender::compositor::NodeOperationBuilder::convert_to_operations(blender::compositor::ExecutionSystem*) /blender/source/blender/compositor/intern/COM_NodeOperationBuilder.cc:44
    #15 0x6ac962b in blender::compositor::ExecutionSystem::ExecutionSystem(RenderData*, Scene*, bNodeTree*, bool, bool, char const*) /blender/source/blender/compositor/intern/COM_ExecutionSystem.cc:52
    #16 0x6a16ef3 in COM_execute /blender/source/blender/compositor/intern/COM_compositor.cc:93
    #17 0x7464c9c in ntreeCompositExecTree /blender/source/blender/nodes/composite/node_composite_tree.cc:183
    #18 0xb4d7ebc in compo_startjob /blender/source/blender/editors/space_node/node_edit.cc:285
    #19 0x3e4b23c in do_job_thread /blender/source/blender/windowmanager/intern/wm_jobs.c:382
    #20 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176
    #21 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c)

Thread T139 created by T127 here:
    #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6)
    #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190
    #2 0x6a65948 in threading_model_queue_start /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:326
    #3 0x6a66383 in blender::compositor::WorkScheduler::start(blender::compositor::CompositorContext const&) /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:456
    #4 0x6a61b23 in blender::compositor::TiledExecutionModel::execute(blender::compositor::ExecutionSystem&) /blender/source/blender/compositor/intern/COM_TiledExecutionModel.cc:114
    #5 0x6acadda in blender::compositor::ExecutionSystem::execute() /blender/source/blender/compositor/intern/COM_ExecutionSystem.cc:99
    #6 0x6a16f06 in COM_execute /blender/source/blender/compositor/intern/COM_compositor.cc:94
    #7 0x7464c9c in ntreeCompositExecTree /blender/source/blender/nodes/composite/node_composite_tree.cc:183
    #8 0xb4d7ebc in compo_startjob /blender/source/blender/editors/space_node/node_edit.cc:285
    #9 0x3e4b23c in do_job_thread /blender/source/blender/windowmanager/intern/wm_jobs.c:382
    #10 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176
    #11 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c)

Thread T127 created by T0 here:
    #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6)
    #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190
    #2 0x3e4c37b in WM_jobs_start /blender/source/blender/windowmanager/intern/wm_jobs.c:473
    #3 0xb4d8a55 in ED_node_composite_job /blender/source/blender/editors/space_node/node_edit.cc:371
    #4 0xb586238 in node_area_refresh /blender/source/blender/editors/space_node/space_node.cc:553
    #5 0x685ecd1 in ED_area_do_refresh /blender/source/blender/editors/screen/area.cc:173
    #6 0x3dd6f5d in wm_event_do_refresh_wm_and_depsgraph /blender/source/blender/windowmanager/intern/wm_event_system.cc:488
    #7 0x3dd9cef in wm_event_do_notifiers /blender/source/blender/windowmanager/intern/wm_event_system.cc:715
    #8 0x3db701a in WM_main /blender/source/blender/windowmanager/intern/wm.c:649
    #9 0x943006 in main /blender/source/creator/creator.c:583
    #10 0x7f148c64a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)

Thread T74 created by T0 here:
    #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6)
    #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190
    #2 0x3e4c37b in WM_jobs_start /blender/source/blender/windowmanager/intern/wm_jobs.c:473
    #3 0xb4d8a55 in ED_node_composite_job /blender/source/blender/editors/space_node/node_edit.cc:371
    #4 0xb586238 in node_area_refresh /blender/source/blender/editors/space_node/space_node.cc:553
    #5 0x685ecd1 in ED_area_do_refresh /blender/source/blender/editors/screen/area.cc:173
    #6 0x3dd6f5d in wm_event_do_refresh_wm_and_depsgraph /blender/source/blender/windowmanager/intern/wm_event_system.cc:488
    #7 0x3dd9cef in wm_event_do_notifiers /blender/source/blender/windowmanager/intern/wm_event_system.cc:715
    #8 0x3db701a in WM_main /blender/source/blender/windowmanager/intern/wm.c:649
    #9 0x943006 in main /blender/source/creator/creator.c:583
    #10 0x7f148c64a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)

SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/blenlib/intern/math_vector_inline.c:58 in copy_v4_v4
Shadow bytes around the buggy address:
  0x0fe3053634f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe305363540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[00]
  0x0fe305363550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0fe305363590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==67998==ABORTING
Can confirm this. Note: I can even repro with `Tiled`. This is what ASAN has to say: ``` ==67998==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f1429b5aa78 at pc 0x000005438b9c bp 0x7f1418eb8230 sp 0x7f1418eb8228 READ of size 4 at 0x7f1429b5aa78 thread T139 #0 0x5438b9b in copy_v4_v4 /blender/source/blender/blenlib/intern/math_vector_inline.c:58 #1 0x543ee90 in nearest_interpolation_color_fl /blender/source/blender/imbuf/intern/imageprocess.c:274 #2 0x543eee4 in nearest_interpolation_color /blender/source/blender/imbuf/intern/imageprocess.c:281 #3 0x6d52d4b in blender::compositor::MultilayerColorOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_MultilayerImageOperation.cc:83 #4 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574) #5 0x6fa6ac3 in blender::compositor::SetAlphaReplaceOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_SetAlphaReplaceOperation.cc:32 #6 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574) #7 0x6c9500f in blender::compositor::MixBlendOperation::execute_pixel_sampled(float*, float, float, blender::compositor::PixelSampler) /blender/source/blender/compositor/operations/COM_MixOperation.cc:181 #8 0x6a6c574 in blender::compositor::NodeOperation::read_sampled(float*, float, float, blender::compositor::PixelSampler) (/build_linux_debug/bin/blender+0x6a6c574) #9 0x6d1c1a7 in blender::compositor::ViewerOperation::execute_region(rcti*, unsigned int) /blender/source/blender/compositor/operations/COM_ViewerOperation.cc:83 #10 0x6b17d7f in blender::compositor::CPUDevice::execute(blender::compositor::WorkPackage*) /blender/source/blender/compositor/intern/COM_CPUDevice.cc:20 #11 0x6a65796 in threading_model_queue_execute /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:308 #12 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176 #13 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c) #14 0x7f148c72fbbf in __clone3 (/lib64/libc.so.6+0x10cbbf) 0x7f1429b5aa78 is located 3146360 bytes inside of 33177608-byte region [0x7f142985a800,0x7f142b7fe808) freed by thread T0 here: #0 0x7f14940b9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388) #1 0x1ff74f10 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:102 #2 0xa72a6d8 in render_result_free /blender/source/blender/render/intern/render_result.cc:83 #3 0xa705f1c in RE_FreeRenderResult /blender/source/blender/render/intern/pipeline.cc:225 #4 0xc1c617 in BKE_image_free_buffers_ex /blender/source/blender/blenkernel/intern/image.cc:615 #5 0xc1c741 in BKE_image_free_buffers /blender/source/blender/blenkernel/intern/image.cc:628 #6 0xc38ee6 in BKE_image_signal /blender/source/blender/blenkernel/intern/image.cc:3168 #7 0x5e7d791 in rna_Image_reload_update /blender/source/blender/makesrna/intern/rna_image.c:102 #8 0x5bb57ec in rna_property_update /blender/source/blender/makesrna/intern/rna_access.cc:2103 #9 0x5bb6072 in RNA_property_update /blender/source/blender/makesrna/intern/rna_access.cc:2172 #10 0x67a0806 in pyrna_py_to_prop /blender/source/blender/python/intern/bpy_rna.c:2088 #11 0x67b23f3 in pyrna_struct_setattro /blender/source/blender/python/intern/bpy_rna.c:4591 #12 0x8c0f83 in PyObject_SetAttr Objects/object.c:1044 previously allocated by thread T74 here: #0 0x7f14940ba097 in calloc (/lib64/libasan.so.8+0xba097) #1 0x1ff75645 in MEM_lockfree_callocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:208 #2 0x1ddc7bcc in imb_exr_multilayer_parse_channels_from_file /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:1672 #3 0x1ddca04c in imb_exr_begin_read_mem /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:1746 #4 0x1ddceb07 in imb_load_openexr /blender/source/blender/imbuf/intern/openexr/openexr_api.cpp:2063 #5 0x5474058 in IMB_ibImageFromMemory /blender/source/blender/imbuf/intern/readimage.c:102 #6 0x54742c6 in IMB_loadifffile /blender/source/blender/imbuf/intern/readimage.c:139 #7 0x54743c0 in IMB_loadiffname /blender/source/blender/imbuf/intern/readimage.c:160 #8 0xc43d05 in load_image_single /blender/source/blender/blenkernel/intern/image.cc:4151 #9 0xc44902 in image_load_image_file /blender/source/blender/blenkernel/intern/image.cc:4220 #10 0xc4533a in image_get_ibuf_multilayer /blender/source/blender/blenkernel/intern/image.cc:4270 #11 0xc4a39d in image_acquire_ibuf /blender/source/blender/blenkernel/intern/image.cc:4683 #12 0xc4ae6e in BKE_image_acquire_ibuf /blender/source/blender/blenkernel/intern/image.cc:4753 #13 0x6a1b1ac in blender::compositor::ImageNode::convert_to_operations(blender::compositor::NodeConverter&, blender::compositor::CompositorContext const&) const /blender/source/blender/compositor/nodes/COM_ImageNode.cc:67 #14 0x6a46301 in blender::compositor::NodeOperationBuilder::convert_to_operations(blender::compositor::ExecutionSystem*) /blender/source/blender/compositor/intern/COM_NodeOperationBuilder.cc:44 #15 0x6ac962b in blender::compositor::ExecutionSystem::ExecutionSystem(RenderData*, Scene*, bNodeTree*, bool, bool, char const*) /blender/source/blender/compositor/intern/COM_ExecutionSystem.cc:52 #16 0x6a16ef3 in COM_execute /blender/source/blender/compositor/intern/COM_compositor.cc:93 #17 0x7464c9c in ntreeCompositExecTree /blender/source/blender/nodes/composite/node_composite_tree.cc:183 #18 0xb4d7ebc in compo_startjob /blender/source/blender/editors/space_node/node_edit.cc:285 #19 0x3e4b23c in do_job_thread /blender/source/blender/windowmanager/intern/wm_jobs.c:382 #20 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176 #21 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c) Thread T139 created by T127 here: #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190 #2 0x6a65948 in threading_model_queue_start /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:326 #3 0x6a66383 in blender::compositor::WorkScheduler::start(blender::compositor::CompositorContext const&) /blender/source/blender/compositor/intern/COM_WorkScheduler.cc:456 #4 0x6a61b23 in blender::compositor::TiledExecutionModel::execute(blender::compositor::ExecutionSystem&) /blender/source/blender/compositor/intern/COM_TiledExecutionModel.cc:114 #5 0x6acadda in blender::compositor::ExecutionSystem::execute() /blender/source/blender/compositor/intern/COM_ExecutionSystem.cc:99 #6 0x6a16f06 in COM_execute /blender/source/blender/compositor/intern/COM_compositor.cc:94 #7 0x7464c9c in ntreeCompositExecTree /blender/source/blender/nodes/composite/node_composite_tree.cc:183 #8 0xb4d7ebc in compo_startjob /blender/source/blender/editors/space_node/node_edit.cc:285 #9 0x3e4b23c in do_job_thread /blender/source/blender/windowmanager/intern/wm_jobs.c:382 #10 0x1ff3ff0e in tslot_thread_start /blender/source/blender/blenlib/intern/threads.cc:176 #11 0x7f148c6ae12c in start_thread (/lib64/libc.so.6+0x8b12c) Thread T127 created by T0 here: #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190 #2 0x3e4c37b in WM_jobs_start /blender/source/blender/windowmanager/intern/wm_jobs.c:473 #3 0xb4d8a55 in ED_node_composite_job /blender/source/blender/editors/space_node/node_edit.cc:371 #4 0xb586238 in node_area_refresh /blender/source/blender/editors/space_node/space_node.cc:553 #5 0x685ecd1 in ED_area_do_refresh /blender/source/blender/editors/screen/area.cc:173 #6 0x3dd6f5d in wm_event_do_refresh_wm_and_depsgraph /blender/source/blender/windowmanager/intern/wm_event_system.cc:488 #7 0x3dd9cef in wm_event_do_notifiers /blender/source/blender/windowmanager/intern/wm_event_system.cc:715 #8 0x3db701a in WM_main /blender/source/blender/windowmanager/intern/wm.c:649 #9 0x943006 in main /blender/source/creator/creator.c:583 #10 0x7f148c64a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) Thread T74 created by T0 here: #0 0x7f149404b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x1ff4014b in BLI_threadpool_insert /blender/source/blender/blenlib/intern/threads.cc:190 #2 0x3e4c37b in WM_jobs_start /blender/source/blender/windowmanager/intern/wm_jobs.c:473 #3 0xb4d8a55 in ED_node_composite_job /blender/source/blender/editors/space_node/node_edit.cc:371 #4 0xb586238 in node_area_refresh /blender/source/blender/editors/space_node/space_node.cc:553 #5 0x685ecd1 in ED_area_do_refresh /blender/source/blender/editors/screen/area.cc:173 #6 0x3dd6f5d in wm_event_do_refresh_wm_and_depsgraph /blender/source/blender/windowmanager/intern/wm_event_system.cc:488 #7 0x3dd9cef in wm_event_do_notifiers /blender/source/blender/windowmanager/intern/wm_event_system.cc:715 #8 0x3db701a in WM_main /blender/source/blender/windowmanager/intern/wm.c:649 #9 0x943006 in main /blender/source/creator/creator.c:583 #10 0x7f148c64a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/blenlib/intern/math_vector_inline.c:58 in copy_v4_v4 Shadow bytes around the buggy address: 0x0fe3053634f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0fe305363540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00[00] 0x0fe305363550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0fe305363590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==67998==ABORTING ```
Philipp Oeser changed title from Full frame compositor ACCESS VIOLATION when updating datablocks from handlers (works fine in tiled mode) #102234 to Compositor ACCESS VIOLATION when updating datablocks from handlers 2023-04-25 12:42:40 +02:00

A much smaller reproducable case:

  • Open the .blend file
  • Run the script
  • Jump between first and last frames

Is very easy to see the problem in a build with an address sanitizer enabled.

I think the proper solution to the problem would be to use implicit shading of the pixels buffer between ImBuf and the OpenEXR handle.

A much smaller reproducable case: - Open the .blend file - Run the script - Jump between first and last frames Is very easy to see the problem in a build with an address sanitizer enabled. I think the proper solution to the problem would be to use implicit shading of the pixels buffer between `ImBuf` and the OpenEXR handle.
Sergey Sharybin added
Type
Bug
and removed
Type
Report
labels 2023-05-01 11:33:30 +02:00
Sergey Sharybin self-assigned this 2023-05-01 11:33:37 +02:00
Blender Bot added
Status
Resolved
and removed
Status
Confirmed
labels 2023-05-23 09:19:46 +02:00
Author

Hi @Sergey , does this commit automatically fix the issue or are changes to the script also needed? Does your commit also open up the ability via the python API to access and modify the render results prior to it writing out? If so, do you have a link to the documentation of those new functions please?

Hi @Sergey , does this commit automatically fix the issue or are changes to the script also needed? Does your commit also open up the ability via the python API to access and modify the render results prior to it writing out? If so, do you have a link to the documentation of those new functions please?

I don't think changes in the script are needed. At least not for the crash I've managed to reproduce and fix.

Does the issue still happen for you?
Keep in mind, it is rather a big change, which also relied on a bigger refactor done in a separate commit, and it was not safe for 3.6, so the fix is only available for 4.0.

I don't think changes in the script are needed. At least not for the crash I've managed to reproduce and fix. Does the issue still happen for you? Keep in mind, it is rather a big change, which also relied on a bigger refactor done in a separate commit, and it was not safe for 3.6, so the fix is only available for 4.0.
Author

Thanks, I'll try in 4.0 then :)

Thanks, I'll try in 4.0 then :)
Author

Hi @Sergey I just tested in 4.0 (today's build) and it now seems to crash immediately during playback even when full frame compositor isn't enabled. Still working fine in 3.51 if full frame compositor isn't enabled.

To replicate:
download this blend file (attached), unzip and open
install the addon from the initial report (above).
go to the compositor
press right arrow once to update the backdrop
press play
crash (see below error logs)

Hi @Sergey I just tested in 4.0 (today's build) and it now seems to crash immediately during playback even when full frame compositor isn't enabled. Still working fine in 3.51 if full frame compositor isn't enabled. To replicate: download this blend file (attached), unzip and open install the addon from the initial report (above). go to the compositor press right arrow once to update the backdrop press play crash (see below error logs)
Author

Hi again @Sergey , I just realised the included exr sequence made the zipped blend file too large to attach here. Please download it from here instead:

https://www.dropbox.com/s/9raz9ysooj15dlw/access%20violation.zip?dl=1

Hi again @Sergey , I just realised the included exr sequence made the zipped blend file too large to attach here. Please download it from here instead: https://www.dropbox.com/s/9raz9ysooj15dlw/access%20violation.zip?dl=1

I wasn't able to reproduce crash with the steps provided in the previous comment.

The way how repro case is organized makes it quite hard to know if the test environment is really the same. For example, the image uses an absolute path to a drive which does not necessarily exist on developer's machines, and the addon uses the path as part of a hashing sued for image file name. So I had to modify that part of the addon to make hashes match between path which works, and the provided image names.

There is a very good reason we ask to simplify the repro case as much as possible:

  • It solves the confusion like described above
  • Makes it easy to track which aspects are fixed, and which are not
  • Saves a lot of time of a handful of developers who look into the reports

I was able to reproduce two other issues, with completely other steps:

  • Deleting Render Layer node, then stating playback would crash. I've reported a simplified an isolated case of it in the #109127.
  • Removing all links during playback with the described setup (addon installed, playback is running) would crash due the buffer_ in the MultilayerBaseOperation::update_memory_buffer_partial is nullptr. Not sure it is a separate issue, as it might be that removing the link first makes animation to stop and leave the scene in some limbo state, and it just crashes in a slightly different place.

The speculation is that when you do a first compositor recalc links are still used from the old state of the file, and starting playback would load a new file, rename the sockets, links gets lost, the addon seems this and attempts to stop the animation playback. Which would make it the same issue as #109127.

Anyway, I suggest subsrcibing the #109127, and if that is not the source of crash you're running into make a more isolated reported.

I wasn't able to reproduce crash with the steps provided in the previous comment. The way how repro case is organized makes it quite hard to know if the test environment is really the same. For example, the image uses an absolute path to a drive which does not necessarily exist on developer's machines, and the addon uses the path as part of a hashing sued for image file name. So I had to modify that part of the addon to make hashes match between path which works, and the provided image names. There is a very good reason we ask to simplify the repro case as much as possible: - It solves the confusion like described above - Makes it easy to track which aspects are fixed, and which are not - Saves a lot of time of a handful of developers who look into the reports I was able to reproduce two other issues, with completely other steps: - Deleting Render Layer node, then stating playback would crash. I've reported a simplified an isolated case of it in the #109127. - Removing all links during playback with the described setup (addon installed, playback is running) would crash due the `buffer_` in the `MultilayerBaseOperation::update_memory_buffer_partial` is `nullptr`. Not sure it is a separate issue, as it might be that removing the link first makes animation to stop and leave the scene in some limbo state, and it just crashes in a slightly different place. The speculation is that when you do a first compositor recalc links are still used from the old state of the file, and starting playback would load a new file, rename the sockets, links gets lost, the addon seems this and attempts to stop the animation playback. Which would make it the same issue as #109127. Anyway, I suggest subsrcibing the #109127, and if that is not the source of crash you're running into make a more isolated reported.
Author

@Sergey I'm really sorry, I hadn't realised that our hashing method was based on the camera scene and viewlayer at the time of originally submitting this bug, and because we now only use the scene and viewlayer, the hash was incorrect as you pointed out.

Please accept my humble apologies for missing that.

As the issue isn't related to #109127 (because nothing is deleted here, and no links are removed/created), I've created a further simplified addon and generated a new bug report here:

#109168

This time I've included two blend files to show that the issue is only present in blender 4.0.

Sorry again for my mistake. I think my Boss is going to contact you too as he's getting a bit panicked due to several thousand people being reliant on this being fixed :s

@Sergey I'm really sorry, I hadn't realised that our hashing method was based on the camera scene and viewlayer at the time of originally submitting this bug, and because we now only use the scene and viewlayer, the hash was incorrect as you pointed out. Please accept my humble apologies for missing that. As the issue isn't related to #109127 (because nothing is deleted here, and no links are removed/created), I've created a further simplified addon and generated a new bug report here: https://projects.blender.org/blender/blender/issues/109168 This time I've included two blend files to show that the issue is only present in blender 4.0. Sorry again for my mistake. I think my Boss is going to contact you too as he's getting a bit panicked due to several thousand people being reliant on this being fixed :s

No problem, don't worry about it :)

Is good to know that no links are removed for you. Would mean there is potentially a 3rd way you usecase crashes Blender.

Thanks for the more isolated report.

No problem, don't worry about it :) Is good to know that no links are removed for you. Would mean there is potentially a 3rd way you usecase crashes Blender. Thanks for the more isolated report.
Sign in to join this conversation.
No Label
Interest
Alembic
Interest
Animation & Rigging
Interest
Asset Browser
Interest
Asset Browser Project Overview
Interest
Audio
Interest
Automated Testing
Interest
Blender Asset Bundle
Interest
BlendFile
Interest
Collada
Interest
Compatibility
Interest
Compositing
Interest
Core
Interest
Cycles
Interest
Dependency Graph
Interest
Development Management
Interest
EEVEE
Interest
EEVEE & Viewport
Interest
Freestyle
Interest
Geometry Nodes
Interest
Grease Pencil
Interest
ID Management
Interest
Images & Movies
Interest
Import Export
Interest
Line Art
Interest
Masking
Interest
Metal
Interest
Modeling
Interest
Modifiers
Interest
Motion Tracking
Interest
Nodes & Physics
Interest
OpenGL
Interest
Overlay
Interest
Overrides
Interest
Performance
Interest
Physics
Interest
Pipeline, Assets & IO
Interest
Platforms, Builds & Tests
Interest
Python API
Interest
Render & Cycles
Interest
Render Pipeline
Interest
Sculpt, Paint & Texture
Interest
Text Editor
Interest
Translations
Interest
Triaging
Interest
Undo
Interest
USD
Interest
User Interface
Interest
UV Editing
Interest
VFX & Video
Interest
Video Sequencer
Interest
Virtual Reality
Interest
Vulkan
Interest
Wayland
Interest
Workbench
Interest: X11
Legacy
Blender 2.8 Project
Legacy
Milestone 1: Basic, Local Asset Browser
Legacy
OpenGL Error
Meta
Good First Issue
Meta
Papercut
Meta
Retrospective
Meta
Security
Module
Animation & Rigging
Module
Core
Module
Development Management
Module
EEVEE & Viewport
Module
Grease Pencil
Module
Modeling
Module
Nodes & Physics
Module
Pipeline, Assets & IO
Module
Platforms, Builds & Tests
Module
Python API
Module
Render & Cycles
Module
Sculpt, Paint & Texture
Module
Triaging
Module
User Interface
Module
VFX & Video
Platform
FreeBSD
Platform
Linux
Platform
macOS
Platform
Windows
Priority
High
Priority
Low
Priority
Normal
Priority
Unbreak Now!
Status
Archived
Status
Confirmed
Status
Duplicate
Status
Needs Info from Developers
Status
Needs Information from User
Status
Needs Triage
Status
Resolved
Type
Bug
Type
Design
Type
Known Issue
Type
Patch
Type
Report
Type
To Do
No Milestone
No project
No Assignees
4 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#107248
No description provided.