Regression: Particle hair crash when using Hair Dynamisc #108198

New Issue

Closed

opened 2023-05-23 16:44:14 +02:00 by kin malmin · 6 comments

kin malmin commented

2023-05-23 16:44:14 +02:00

System Information
Operating system: Windows-10-10.0.19045-SP0 64 Bits
Graphics card: NVIDIA GeForce RTX 3080 Laptop GPU/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 531.41

Blender Version
Broken: version: 3.6.0 Beta, branch: blender-v3.6-release, commit date: 2023-05-22 21:38, hash: 43fe7bec4fa5
Worked: (3.5.1)

Caused by 7eee378ecc

Short description of error
Press play with partical hair when Hair Dynamics is Enable will rash blender.

Exact steps for others to reproduce the error

Add a partickle system and changes it to hair.
Enable Hair Dynamics.
Press play and blender crashes.

**System Information** Operating system: Windows-10-10.0.19045-SP0 64 Bits Graphics card: NVIDIA GeForce RTX 3080 Laptop GPU/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 531.41 **Blender Version** Broken: version: 3.6.0 Beta, branch: blender-v3.6-release, commit date: 2023-05-22 21:38, hash: `43fe7bec4fa5` Worked: (3.5.1) Caused by 7eee378eccc8 **Short description of error** Press play with partical hair when Hair Dynamics is Enable will rash blender. **Exact steps for others to reproduce the error** 1. Add a partickle system and changes it to hair. 2. Enable Hair Dynamics. 3. Press play and blender crashes.

hair bug1.blend

136 KiB

kin malmin added the

labels 2023-05-23 16:44:15 +02:00

Iliya Katushenock added the

Nodes & Physics

label 2023-05-23 20:16:40 +02:00

Germano Cavalcante commented

2023-05-24 20:06:49 +02:00

Member

I can't reproduce the problem to confirm it and this report still doesn't have much information to know what's going on :\

Maybe the debug logs can give you a clue as to what's going on.

So please open Blender's installation directory and double click on the blender_debug_gpu.cmd. This will start Blender in debug mode and create log files.
Try to reproduce the error again.
Once it crashes, the Windows Explorer should open and show you up to two files, a debug log and the system information.
Add them to your bug report by clicking on the upload button below or via drag and drop.
Please also upload the crash log located in C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt (or simply type %TEMP% into the path bar of the Windows Explorer).

I can't reproduce the problem to confirm it and this report still doesn't have much information to know what's going on :\ Maybe the debug logs can give you a clue as to what's going on. So please open Blender's installation directory and double click on the `blender_debug_gpu.cmd`. This will start Blender in debug mode and create log files. Try to reproduce the error again. Once it crashes, the Windows Explorer should open and show you up to two files, a debug log and the system information. Add them to your bug report by clicking on the upload button below or via drag and drop. Please also upload the crash log located in `C:\Users\[your username]\AppData\Local\Temp\[project name].crash.txt` (or simply type `%TEMP%` into the path bar of the Windows Explorer).

Germano Cavalcante added

Needs Information from User

and removed

labels 2023-05-24 20:07:02 +02:00

Pratik Borhade commented

2023-05-26 05:40:01 +02:00

Member

I can confirm the crash.

I can confirm the crash.

stack-trace.txt

9.9 KiB

Pratik Borhade added

and removed

Needs Information from User

labels 2023-05-26 05:41:10 +02:00

Pratik Borhade commented

2023-05-26 06:14:28 +02:00

Member

Unable to bisect due to build failure. Crash started to happen between d48939f103c0 - 37b7702d74

I suspect this is caused by 2a4323c2f5

Unable to bisect due to build failure. Crash started to happen between `d48939f103c0 - 37b7702d74` I suspect this is caused by 2a4323c2f51f92fc1c88561cbf23004b42138ad2

Pratik Borhade added

and removed

labels 2023-05-26 06:14:53 +02:00

Pratik Borhade changed title from ~~Particle hair crash when using Hair Dynamisc~~ to Regression: Particle hair crash when using Hair Dynamisc

2023-05-26 06:15:35 +02:00

Philipp Oeser commented

2023-05-26 10:26:56 +02:00

Member

Caused by 7eee378ecc

CC @JacquesLucke

==1180478==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000564408 at pc 0x0000030c44ba bp 0x7f838920fab0 sp 0x7f838920faa8
READ of size 4 at 0x62e000564408 thread T59
    #0 0x30c44b9 in bvhtree_update_from_cloth /blender/source/blender/blenkernel/intern/cloth.cc:185
    #1 0x31201df in cloth_bvh_collision /blender/source/blender/blenkernel/intern/collision.cc:1587
    #2 0x64ef385 in cloth_solve_collisions /blender/source/blender/simulation/intern/SIM_mass_spring.cpp:1197
    #3 0x64f1e72 in SIM_cloth_solve /blender/source/blender/simulation/intern/SIM_mass_spring.cpp:1316
    #4 0x30c61c2 in do_step_cloth /blender/source/blender/blenkernel/intern/cloth.cc:302
    #5 0x30c7ab5 in clothModifier_do /blender/source/blender/blenkernel/intern/cloth.cc:415
    #6 0x135e592 in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3509
    #7 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551
    #8 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880
    #9 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215
    #10 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021
    #11 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699
    #12 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461
    #13 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642
    #14 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165
    #15 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331
    #16 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619
    #17 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61
    #18 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111
    #19 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290
    #20 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591
    #21 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101
    #22 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    #23 0x1e5df534 in Task::operator()() const /blender/source/blender/blenlib/intern/task_pool.cc:164
    #24 0x1e5e2cee in tbb::internal::function_task<Task>::execute() /lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059
    #25 0x7f83e53d5b44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/build_linux_debug/bin/lib/libtbb.so.2+0x29b44)
    #26 0x7f83e53d5e77 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/build_linux_debug/bin/lib/libtbb.so.2+0x29e77)
    #27 0x7f83e53be756 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/build_linux_debug/bin/lib/libtbb.so.2+0x12756)
    #28 0x7f83e53ccabf in tbb::internal::market::process(rml::job&) (/build_linux_debug/bin/lib/libtbb.so.2+0x20abf)
    #29 0x7f83e53d059b in tbb::internal::rml::private_worker::run() (/build_linux_debug/bin/lib/libtbb.so.2+0x2459b)
    #30 0x7f83e53d07d8 in tbb::internal::rml::private_worker::thread_routine(void*) (/build_linux_debug/bin/lib/libtbb.so.2+0x247d8)
    #31 0x7f83db4ae12c in start_thread (/lib64/libc.so.6+0x8b12c)
    #32 0x7f83db52fbbf in __clone3 (/lib64/libc.so.6+0x10cbbf)

0x62e000564408 is located 8 bytes inside of 48008-byte region [0x62e000564400,0x62e00056ff88)
freed by thread T59 here:
    #0 0x7f83e4cb9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388)
    #1 0x1e628622 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:102
    #2 0x332008d in free_layer_data /blender/source/blender/blenkernel/intern/customdata.cc:2193
    #3 0x334e15e in CustomDataLayerImplicitSharing::delete_self_with_data() /blender/source/blender/blenkernel/intern/customdata.cc:2353
    #4 0xadb464 in blender::ImplicitSharingInfo::remove_user_and_delete_if_last() const /blender/source/blender/blenlib/BLI_implicit_sharing.hh:143
    #5 0x3323fc9 in customData_free_layer__internal /blender/source/blender/blenkernel/intern/customdata.cc:2481
    #6 0x3324333 in CustomData_free /blender/source/blender/blenkernel/intern/customdata.cc:2503
    #7 0xed08ea in mesh_clear_geometry /blender/source/blender/blenkernel/intern/mesh.cc:877
    #8 0xed15ad in BKE_mesh_clear_geometry_and_metadata /blender/source/blender/blenkernel/intern/mesh.cc:912
    #9 0xec2b4c in mesh_free_data /blender/source/blender/blenkernel/intern/mesh.cc:203
    #10 0xd8f467 in BKE_libblock_free_datablock /blender/source/blender/blenkernel/intern/lib_id_delete.c:74
    #11 0xd8f9bd in BKE_id_free_ex /blender/source/blender/blenkernel/intern/lib_id_delete.c:133
    #12 0xd8fc9a in BKE_id_free /blender/source/blender/blenkernel/intern/lib_id_delete.c:174
    #13 0x135ddbf in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3497
    #14 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551
    #15 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880
    #16 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215
    #17 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021
    #18 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699
    #19 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461
    #20 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642
    #21 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165
    #22 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331
    #23 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619
    #24 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61
    #25 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111
    #26 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290
    #27 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591
    #28 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101
    #29 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118

previously allocated by thread T0 here:
    #0 0x7f83e4cba6af in __interceptor_malloc (/lib64/libasan.so.8+0xba6af)
    #1 0x1e628fbc in MEM_lockfree_mallocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:247
    #2 0x1e628796 in MEM_lockfree_dupallocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:118
    #3 0x331fef7 in copy_layer_data /blender/source/blender/blenkernel/intern/customdata.cc:2184
    #4 0x3322453 in ensure_layer_data_is_mutable /blender/source/blender/blenkernel/intern/customdata.cc:2394
    #5 0x3333226 in CustomData_get_layer_named_for_write /blender/source/blender/blenkernel/intern/customdata.cc:3611
    #6 0x13596b8 in hair_create_input_mesh /blender/source/blender/blenkernel/intern/particle_system.c:3335
    #7 0x135dcfa in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3494
    #8 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551
    #9 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880
    #10 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215
    #11 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021
    #12 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699
    #13 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461
    #14 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642
    #15 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165
    #16 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331
    #17 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619
    #18 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61
    #19 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111
    #20 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290
    #21 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591
    #22 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101
    #23 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    #24 0x1e5df534 in Task::operator()() const /blender/source/blender/blenlib/intern/task_pool.cc:164
    #25 0x1e5e2cee in tbb::internal::function_task<Task>::execute() /lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059
    #26 0x7f83e53d5b44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/build_linux_debug/bin/lib/libtbb.so.2+0x29b44)

Thread T59 created by T54 here:
    #0 0x7f83e4c4b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6)
    #1 0x7f83e53d0488 in tbb::internal::rml::private_server::wake_some(int) (/build_linux_debug/bin/lib/libtbb.so.2+0x24488)
    #2 0x62d0000e417f  (<unknown module>)

Thread T54 created by T0 here:
    #0 0x7f83e4c4b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6)
    #1 0x7f83e53d0488 in tbb::internal::rml::private_server::wake_some(int) (/build_linux_debug/bin/lib/libtbb.so.2+0x24488)
    #2 0x62d0000e437f  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/blenkernel/intern/cloth.cc:185 in bvhtree_update_from_cloth
Shadow bytes around the buggy address:
  0x0c5c800a4830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c800a4840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c800a4850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c800a4860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c5c800a4870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c5c800a4880: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5c800a4890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5c800a48a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5c800a48b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5c800a48c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c5c800a48d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==1180478==ABORTING

Caused by 7eee378eccc8 CC @JacquesLucke ``` ==1180478==ERROR: AddressSanitizer: heap-use-after-free on address 0x62e000564408 at pc 0x0000030c44ba bp 0x7f838920fab0 sp 0x7f838920faa8 READ of size 4 at 0x62e000564408 thread T59 #0 0x30c44b9 in bvhtree_update_from_cloth /blender/source/blender/blenkernel/intern/cloth.cc:185 #1 0x31201df in cloth_bvh_collision /blender/source/blender/blenkernel/intern/collision.cc:1587 #2 0x64ef385 in cloth_solve_collisions /blender/source/blender/simulation/intern/SIM_mass_spring.cpp:1197 #3 0x64f1e72 in SIM_cloth_solve /blender/source/blender/simulation/intern/SIM_mass_spring.cpp:1316 #4 0x30c61c2 in do_step_cloth /blender/source/blender/blenkernel/intern/cloth.cc:302 #5 0x30c7ab5 in clothModifier_do /blender/source/blender/blenkernel/intern/cloth.cc:415 #6 0x135e592 in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3509 #7 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551 #8 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880 #9 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215 #10 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021 #11 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699 #12 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461 #13 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642 #14 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165 #15 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331 #16 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619 #17 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61 #18 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111 #19 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290 #20 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591 #21 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101 #22 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 #23 0x1e5df534 in Task::operator()() const /blender/source/blender/blenlib/intern/task_pool.cc:164 #24 0x1e5e2cee in tbb::internal::function_task<Task>::execute() /lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059 #25 0x7f83e53d5b44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/build_linux_debug/bin/lib/libtbb.so.2+0x29b44) #26 0x7f83e53d5e77 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/build_linux_debug/bin/lib/libtbb.so.2+0x29e77) #27 0x7f83e53be756 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/build_linux_debug/bin/lib/libtbb.so.2+0x12756) #28 0x7f83e53ccabf in tbb::internal::market::process(rml::job&) (/build_linux_debug/bin/lib/libtbb.so.2+0x20abf) #29 0x7f83e53d059b in tbb::internal::rml::private_worker::run() (/build_linux_debug/bin/lib/libtbb.so.2+0x2459b) #30 0x7f83e53d07d8 in tbb::internal::rml::private_worker::thread_routine(void*) (/build_linux_debug/bin/lib/libtbb.so.2+0x247d8) #31 0x7f83db4ae12c in start_thread (/lib64/libc.so.6+0x8b12c) #32 0x7f83db52fbbf in __clone3 (/lib64/libc.so.6+0x10cbbf) 0x62e000564408 is located 8 bytes inside of 48008-byte region [0x62e000564400,0x62e00056ff88) freed by thread T59 here: #0 0x7f83e4cb9388 in __interceptor_free.part.0 (/lib64/libasan.so.8+0xb9388) #1 0x1e628622 in MEM_lockfree_freeN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:102 #2 0x332008d in free_layer_data /blender/source/blender/blenkernel/intern/customdata.cc:2193 #3 0x334e15e in CustomDataLayerImplicitSharing::delete_self_with_data() /blender/source/blender/blenkernel/intern/customdata.cc:2353 #4 0xadb464 in blender::ImplicitSharingInfo::remove_user_and_delete_if_last() const /blender/source/blender/blenlib/BLI_implicit_sharing.hh:143 #5 0x3323fc9 in customData_free_layer__internal /blender/source/blender/blenkernel/intern/customdata.cc:2481 #6 0x3324333 in CustomData_free /blender/source/blender/blenkernel/intern/customdata.cc:2503 #7 0xed08ea in mesh_clear_geometry /blender/source/blender/blenkernel/intern/mesh.cc:877 #8 0xed15ad in BKE_mesh_clear_geometry_and_metadata /blender/source/blender/blenkernel/intern/mesh.cc:912 #9 0xec2b4c in mesh_free_data /blender/source/blender/blenkernel/intern/mesh.cc:203 #10 0xd8f467 in BKE_libblock_free_datablock /blender/source/blender/blenkernel/intern/lib_id_delete.c:74 #11 0xd8f9bd in BKE_id_free_ex /blender/source/blender/blenkernel/intern/lib_id_delete.c:133 #12 0xd8fc9a in BKE_id_free /blender/source/blender/blenkernel/intern/lib_id_delete.c:174 #13 0x135ddbf in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3497 #14 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551 #15 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880 #16 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215 #17 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021 #18 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699 #19 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461 #20 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642 #21 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165 #22 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331 #23 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619 #24 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61 #25 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111 #26 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290 #27 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591 #28 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101 #29 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 previously allocated by thread T0 here: #0 0x7f83e4cba6af in __interceptor_malloc (/lib64/libasan.so.8+0xba6af) #1 0x1e628fbc in MEM_lockfree_mallocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:247 #2 0x1e628796 in MEM_lockfree_dupallocN /blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:118 #3 0x331fef7 in copy_layer_data /blender/source/blender/blenkernel/intern/customdata.cc:2184 #4 0x3322453 in ensure_layer_data_is_mutable /blender/source/blender/blenkernel/intern/customdata.cc:2394 #5 0x3333226 in CustomData_get_layer_named_for_write /blender/source/blender/blenkernel/intern/customdata.cc:3611 #6 0x13596b8 in hair_create_input_mesh /blender/source/blender/blenkernel/intern/particle_system.c:3335 #7 0x135dcfa in do_hair_dynamics /blender/source/blender/blenkernel/intern/particle_system.c:3494 #8 0x135fc6f in hair_step /blender/source/blender/blenkernel/intern/particle_system.c:3551 #9 0x1378155 in particle_system_update /blender/source/blender/blenkernel/intern/particle_system.c:4880 #10 0x561c9b7 in deformVerts /blender/source/blender/modifiers/intern/MOD_particlesystem.cc:215 #11 0x1003225 in BKE_modifier_deform_verts /blender/source/blender/blenkernel/intern/modifier.cc:1021 #12 0x2f8b15e in mesh_calc_modifiers /blender/source/blender/blenkernel/intern/DerivedMesh.cc:699 #13 0x2f945ea in mesh_build_data /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1461 #14 0x2f9695f in makeDerivedMesh /blender/source/blender/blenkernel/intern/DerivedMesh.cc:1642 #15 0x1259011 in BKE_object_handle_data_update /blender/source/blender/blenkernel/intern/object_update.cc:165 #16 0x125b35a in BKE_object_eval_uber_data /blender/source/blender/blenkernel/intern/object_update.cc:331 #17 0x48f05d1 in operator() /blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1619 #18 0x4923a96 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:61 #19 0x491bd0c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/12/bits/invoke.h:111 #20 0x491370f in _M_invoke /usr/include/c++/12/bits/std_function.h:290 #21 0x483c7ce in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/12/bits/std_function.h:591 #22 0x4836daf in evaluate_node /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:101 #23 0x48371e1 in deg_task_run_func /blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 #24 0x1e5df534 in Task::operator()() const /blender/source/blender/blenlib/intern/task_pool.cc:164 #25 0x1e5e2cee in tbb::internal::function_task<Task>::execute() /lib/linux_x86_64_glibc_228/tbb/include/tbb/task.h:1059 #26 0x7f83e53d5b44 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/build_linux_debug/bin/lib/libtbb.so.2+0x29b44) Thread T59 created by T54 here: #0 0x7f83e4c4b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x7f83e53d0488 in tbb::internal::rml::private_server::wake_some(int) (/build_linux_debug/bin/lib/libtbb.so.2+0x24488) #2 0x62d0000e417f (<unknown module>) Thread T54 created by T0 here: #0 0x7f83e4c4b3e6 in __interceptor_pthread_create (/lib64/libasan.so.8+0x4b3e6) #1 0x7f83e53d0488 in tbb::internal::rml::private_server::wake_some(int) (/build_linux_debug/bin/lib/libtbb.so.2+0x24488) #2 0x62d0000e437f (<unknown module>) SUMMARY: AddressSanitizer: heap-use-after-free /blender/source/blender/blenkernel/intern/cloth.cc:185 in bvhtree_update_from_cloth Shadow bytes around the buggy address: 0x0c5c800a4830: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c5c800a4840: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c5c800a4850: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c5c800a4860: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c5c800a4870: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c5c800a4880: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c5c800a4890: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c5c800a48a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c5c800a48b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c5c800a48c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c5c800a48d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1180478==ABORTING ```

Pratik Borhade referenced this issue

2023-05-30 06:51:27 +02:00

Crash when using Hair Dynamics #108406

Chao Li commented

2023-05-31 21:03:34 +02:00

Contributor

Hello. I think I found the reason. In line 879 of cloth.cc (clmd->clothObject->edges = reinterpret_cast<const vec2i *>(mesh->edges().data());), edges were assigned. This function cloth_from_mesh() was never called for later frames, assuming the edges won't be freed.
However, implicit sharing was introduced since 7eee378eccc8. The assumption here is no longer true.

I tried to add the same line to line 244 in cloth.cc and blender didn't crash. But I'm not sure if this is the best way to fix this.

Hello. I think I found the reason. In line 879 of cloth.cc (`clmd->clothObject->edges = reinterpret_cast<const vec2i *>(mesh->edges().data());`), edges were assigned. This function `cloth_from_mesh()` was never called for later frames, assuming the edges won't be freed. However, implicit sharing was introduced since [7eee378eccc8](https://projects.blender.org/blender/blender/commit/7eee378eccc8). The assumption here is no longer true. I tried to add the same line to line 244 in cloth.cc and blender didn't crash. But I'm not sure if this is the best way to fix this.

Chao Li commented

2023-05-31 21:22:01 +02:00

Contributor

The alternative solution is, in do_hair_dynamics function (line 3494), change from

  hair_create_input_mesh(sim, totpoint, totedge, &psys->hair_in_mesh);

  if (psys->hair_out_mesh) {
    BKE_id_free(NULL, psys->hair_out_mesh);
  }

to

  if (psys->hair_out_mesh) {
    BKE_id_free(NULL, psys->hair_out_mesh);
  }

  hair_create_input_mesh(sim, totpoint, totedge, &psys->hair_in_mesh);

Since hair_out_mesh is freed, hair_in_mesh will be the only strong user of CustomData edata. Therefore, copying on write won't happen and clmd->clothObject->edges doesn't need to be updated.

The alternative solution is, in do_hair_dynamics function (line 3494), change from ``` hair_create_input_mesh(sim, totpoint, totedge, &psys->hair_in_mesh); if (psys->hair_out_mesh) { BKE_id_free(NULL, psys->hair_out_mesh); } ``` to ``` if (psys->hair_out_mesh) { BKE_id_free(NULL, psys->hair_out_mesh); } hair_create_input_mesh(sim, totpoint, totedge, &psys->hair_in_mesh); ``` Since hair_out_mesh is freed, hair_in_mesh will be the only strong user of CustomData edata. Therefore, copying on write won't happen and `clmd->clothObject->edges` doesn't need to be updated.

Chao Li referenced a pull request that will close this issue

2023-05-31 21:39:43 +02:00

Fix #108198: Particle hair crash when using Hair Dynamics #108480

Hans Goudey referenced this issue from a commit

2023-06-06 18:46:42 +02:00

Fix #108198: Particle hair crash when using Hair Dynamics

Hans Goudey closed this issue

2023-06-06 18:46:43 +02:00

Blender Bot added

and removed

labels 2023-06-06 18:46:44 +02:00

Sign in to join this conversation.

No Label

Animation & Rigging

Asset Browser Project Overview

Automated Testing

Blender Asset Bundle

Dependency Graph

Development Management

EEVEE & Viewport

Images & Movies

Motion Tracking

Nodes & Physics

Pipeline, Assets & IO

Platforms, Builds & Tests

Render & Cycles

Render Pipeline

Sculpt, Paint & Texture

Video Sequencer

Virtual Reality

Blender 2.8 Project

Milestone 1: Basic, Local Asset Browser

Good First Issue

Animation & Rigging

Development Management

EEVEE & Viewport

Nodes & Physics

Pipeline, Assets & IO

Platforms, Builds & Tests

Render & Cycles

Sculpt, Paint & Texture

Needs Info from Developers

Needs Information from User

No Milestone

No project

No Assignees

5 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#108198

No description provided.