Blender Crashes when I click on Bake #107420

New Issue

Prest · 2023-04-28T06:00:05+02:00

Prest commented

2023-04-28 06:00:05 +02:00

System Information
Operating system: Windows-10-10.0.22000-SP0 64 Bits
Graphics card: NVIDIA GeForce RTX 4070 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 528.24

Blender Version
Broken: version: 3.4.1, branch: blender-v3.4-release, commit date: 2022-12-19 17:00, hash: rB55485cb379f7
Worked: bake works for other files but not this one

Short description of error
Blender crashes on clicking bake. Console window shows the following after the crash:
Error : EXCEPTION_ACCESS_VIOLATION
Address : 0x00007FF62175EED0
Module : blender.exe
Thread : 00002360
Writing: C:\Users[username]\AppData\Local\Temp\test.crash.txt

This is driving me crazy. Please see if you can find something as to why this crash is happening/
Thanks

Exact steps for others to reproduce the error
Load file test.blend
Select Scene Properties -> Bake
Blender Crashes

**System Information** Operating system: Windows-10-10.0.22000-SP0 64 Bits Graphics card: NVIDIA GeForce RTX 4070 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 528.24 **Blender Version** Broken: version: 3.4.1, branch: blender-v3.4-release, commit date: 2022-12-19 17:00, hash: `rB55485cb379f7` Worked: bake works for other files but not this one **Short description of error** Blender crashes on clicking bake. Console window shows the following after the crash: Error : EXCEPTION_ACCESS_VIOLATION Address : 0x00007FF62175EED0 Module : blender.exe Thread : 00002360 Writing: C:\Users\[username]\AppData\Local\Temp\test.crash.txt This is driving me crazy. Please see if you can find something as to why this crash is happening/ Thanks **Exact steps for others to reproduce the error** Load file test.blend Select Scene Properties -> Bake Blender Crashes

test.crash.txt

38 KiB

test.blend

277 KiB

Prest added the

labels 2023-04-28 06:00:06 +02:00

Philipp Oeser commented

2023-04-28 09:13:12 +02:00

Can confirm.

There is just nothing in this rigid body world to bake.

Can be reproduced from scratch like this:

remove all objects from the scene
add rigid body world
bake
crash

Of course, crash should not happen, will check.

Can confirm. There is just nothing in this rigid body world to bake. Can be reproduced from scratch like this: - remove all objects from the scene - add rigid body world - bake - crash Of course, crash should not happen, will check.

Philipp Oeser added

and removed

labels 2023-04-28 09:13:20 +02:00

Philipp Oeser self-assigned this 2023-04-28 10:36:22 +02:00

Prest commented

2023-04-29 19:46:29 +02:00

Hi Phillip

Thanks for looking into this. We tried adding a cube to rigid boy. Here are two files ; one that works and another that crashes every time on bake. Is there an easy way to see the diff between the two blend files ? It really drives me crazy. Appreciate your help.

Hi Phillip Thanks for looking into this. We tried adding a cube to rigid boy. Here are two files ; one that works and another that crashes every time on bake. Is there an easy way to see the diff between the two blend files ? It really drives me crazy. Appreciate your help.

test.blend

281 KiB

test_working.blend

134 KiB

Philipp Oeser referenced a pull request that will close this issue

2023-05-02 13:04:40 +02:00

Fix #107420: crash getting PTCacheID when baking scene rigid body world #107536

Philipp Oeser commented

2023-05-02 13:06:30 +02:00

ptcache_baker_create false assumed the PointCache owner id is always an object, but when baking rigid body world it is a scene. Code would cast the ID to an object and passed that to BKE_ptcache_id_find / BKE_ptcache_ids_from_object (which can get terribly wrong -- reading something on the scene as something from the assumed object).

Prior to f61ff22967 this was less likely to be a problem, but that commit introduced a DrawDataList into the struct Scene. In the file from the report, this would lead to foreach_object_particle_ptcachenow recognizing garbage memory as a particle system, accessing itsParticleSettings phystype` would then crash.

==1159485==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00005c365f83 at pc 0x000001631cb0 bp 0x7ffde98a8cc0 sp 0x7ffde98a8cb8
READ of size 8 at 0x00005c365f83 thread T0
    #0 0x1631caf in foreach_object_particle_ptcache /blender/source/blender/blenkernel/intern/pointcache.c:1124
    #1 0x1632a00 in foreach_object_ptcache /blender/source/blender/blenkernel/intern/pointcache.c:1200
    #2 0x16333db in BKE_ptcache_ids_from_object /blender/source/blender/blenkernel/intern/pointcache.c:1250
    #3 0x1631678 in BKE_ptcache_id_find /blender/source/blender/blenkernel/intern/pointcache.c:1092
    #4 0x96bad7d in ptcache_baker_create /blender/source/blender/editors/physics/physics_pointcache.c:193
    #5 0x96bb253 in ptcache_bake_invoke /blender/source/blender/editors/physics/physics_pointcache.c:216
    #6 0x3df301d in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.cc:1527
    #7 0x3df4d77 in wm_operator_call_internal /blender/source/blender/windowmanager/intern/wm_event_system.cc:1727
    #8 0x3df4fdc in WM_operator_name_call_ptr /blender/source/blender/windowmanager/intern/wm_event_system.cc:1775
    #9 0x3df64ef in WM_operator_name_call_ptr_with_depends_on_cursor /blender/source/blender/windowmanager/intern/wm_event_system.cc:1968
    #10 0xa27c965 in ui_apply_but_funcs_after /blender/source/blender/editors/interface/interface_handlers.cc:1021
    #11 0xa30ea9f in ui_handler_region_menu /blender/source/blender/editors/interface/interface_handlers.cc:11450
    #12 0x3debe24 in wm_handler_ui_call /blender/source/blender/windowmanager/intern/wm_event_system.cc:814
    #13 0x3e05b20 in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.cc:3305
    #14 0x3e06ed7 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.cc:3422
    #15 0x3e1140d in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.cc:4044
    #16 0x3dc838c in WM_main /blender/source/blender/windowmanager/intern/wm.c:646
    #17 0x943a06 in main /blender/source/creator/creator.c:583
    #18 0x7f0195a4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f)
    #19 0x7f0195a4a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8)
    #20 0x942be4 in _start (/build_linux_debug/bin/blender+0x942be4)

0x00005c365f83 is located 33 bytes to the right of global variable '*.Lubsan_type2253' defined in '/blender/extern/ceres/internal/ceres/generated/schur_eliminator_2_2_2.cc' (0x5c365f40) of size 34
0x00005c365f83 is located 29 bytes to the left of global variable '*.Lubsan_type2254' defined in '/blender/extern/ceres/internal/ceres/generated/schur_eliminator_2_2_2.cc' (0x5c365fa0) of size 27
SUMMARY: AddressSanitizer: global-buffer-overflow /blender/source/blender/blenkernel/intern/pointcache.c:1124 in foreach_object_particle_ptcache
Shadow bytes around the buggy address:
  0x00008b864ba0: 00 00 07 f9 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9
  0x00008b864bb0: 00 00 07 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9
  0x00008b864bc0: 00 00 07 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9
  0x00008b864bd0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9
  0x00008b864be0: 00 00 00 04 f9 f9 f9 f9 00 00 00 00 02 f9 f9 f9
=>0x00008b864bf0:[f9]f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 00 05
  0x00008b864c00: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 00 f9
  0x00008b864c10: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 00 f9
  0x00008b864c20: f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 07 f9
  0x00008b864c30: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 05
  0x00008b864c40: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 07 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1159485==ABORTING

`ptcache_baker_create` false assumed the PointCache owner id is always an **object**, but when baking rigid body world it is a **scene**. Code would cast the ID to an object and passed that to `BKE_ptcache_id_find` / `BKE_ptcache_ids_from_object` (which can get terribly wrong -- reading _something_ on the scene as something from the assumed object). Prior to f61ff22967c5 this was less likely to be a problem, but that commit introduced a `DrawDataList` into the `struct Scene. In the file from the report, this would lead to `foreach_object_particle_ptcache` now recognizing garbage memory as a particle system, accessing its `ParticleSettings` `phystype` would then crash. ``` ==1159485==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00005c365f83 at pc 0x000001631cb0 bp 0x7ffde98a8cc0 sp 0x7ffde98a8cb8 READ of size 8 at 0x00005c365f83 thread T0 #0 0x1631caf in foreach_object_particle_ptcache /blender/source/blender/blenkernel/intern/pointcache.c:1124 #1 0x1632a00 in foreach_object_ptcache /blender/source/blender/blenkernel/intern/pointcache.c:1200 #2 0x16333db in BKE_ptcache_ids_from_object /blender/source/blender/blenkernel/intern/pointcache.c:1250 #3 0x1631678 in BKE_ptcache_id_find /blender/source/blender/blenkernel/intern/pointcache.c:1092 #4 0x96bad7d in ptcache_baker_create /blender/source/blender/editors/physics/physics_pointcache.c:193 #5 0x96bb253 in ptcache_bake_invoke /blender/source/blender/editors/physics/physics_pointcache.c:216 #6 0x3df301d in wm_operator_invoke /blender/source/blender/windowmanager/intern/wm_event_system.cc:1527 #7 0x3df4d77 in wm_operator_call_internal /blender/source/blender/windowmanager/intern/wm_event_system.cc:1727 #8 0x3df4fdc in WM_operator_name_call_ptr /blender/source/blender/windowmanager/intern/wm_event_system.cc:1775 #9 0x3df64ef in WM_operator_name_call_ptr_with_depends_on_cursor /blender/source/blender/windowmanager/intern/wm_event_system.cc:1968 #10 0xa27c965 in ui_apply_but_funcs_after /blender/source/blender/editors/interface/interface_handlers.cc:1021 #11 0xa30ea9f in ui_handler_region_menu /blender/source/blender/editors/interface/interface_handlers.cc:11450 #12 0x3debe24 in wm_handler_ui_call /blender/source/blender/windowmanager/intern/wm_event_system.cc:814 #13 0x3e05b20 in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.cc:3305 #14 0x3e06ed7 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.cc:3422 #15 0x3e1140d in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.cc:4044 #16 0x3dc838c in WM_main /blender/source/blender/windowmanager/intern/wm.c:646 #17 0x943a06 in main /blender/source/creator/creator.c:583 #18 0x7f0195a4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) #19 0x7f0195a4a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8) #20 0x942be4 in _start (/build_linux_debug/bin/blender+0x942be4) 0x00005c365f83 is located 33 bytes to the right of global variable '*.Lubsan_type2253' defined in '/blender/extern/ceres/internal/ceres/generated/schur_eliminator_2_2_2.cc' (0x5c365f40) of size 34 0x00005c365f83 is located 29 bytes to the left of global variable '*.Lubsan_type2254' defined in '/blender/extern/ceres/internal/ceres/generated/schur_eliminator_2_2_2.cc' (0x5c365fa0) of size 27 SUMMARY: AddressSanitizer: global-buffer-overflow /blender/source/blender/blenkernel/intern/pointcache.c:1124 in foreach_object_particle_ptcache Shadow bytes around the buggy address: 0x00008b864ba0: 00 00 07 f9 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 0x00008b864bb0: 00 00 07 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 0x00008b864bc0: 00 00 07 f9 f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 0x00008b864bd0: 00 00 00 f9 f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 0x00008b864be0: 00 00 00 04 f9 f9 f9 f9 00 00 00 00 02 f9 f9 f9 =>0x00008b864bf0:[f9]f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 00 05 0x00008b864c00: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 00 f9 0x00008b864c10: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 00 f9 0x00008b864c20: f9 f9 f9 f9 00 00 00 03 f9 f9 f9 f9 00 00 07 f9 0x00008b864c30: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 00 05 0x00008b864c40: f9 f9 f9 f9 00 00 00 04 f9 f9 f9 f9 00 00 07 f9 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1159485==ABORTING ```

Philipp Oeser referenced this issue

2023-05-02 13:15:43 +02:00

Fix: crash baking empty rigid body world #107537

Philipp Oeser referenced this issue from a commit

2023-05-02 17:56:24 +02:00

Fix #107420: crash getting PTCacheID when baking scene rigid body world

Philipp Oeser closed this issue

2023-05-02 17:56:25 +02:00

Blender Bot added

Status

Resolved

and removed