Crash loading file with library overrides and object-linked materials #111907

New Issue

RedMser · 2023-09-04T01:13:41+02:00

RedMser commented

2023-09-04 01:13:41 +02:00

System Information
Operating system: Windows-10-10.0.19044-SP0 64 Bits
Graphics card: NVIDIA GeForce RTX 2080/PCIe/SSE2 NVIDIA Corporation 4.6.0 NVIDIA 531.68

Blender Version
Broken: version: 4.0.0 Alpha, branch: main, commit date: 2023-08-10 03:47, hash: 4ad63687cbc4
Worked: version: 3.6.1 Release Candidate, branch: blender-v3.6-release, commit date: 2023-07-13 21:11, hash: a8b82bd89e66

Bisect revealed a05419f18b is the first bad commit

Short description of error
I'm currently getting the same crash as reported in #110749 except I was able to reproduce it in a simple file!
It crashes due to weird manipulation of the material slots of a library override object. You need to modify the object-linked AND data-linked material slots. Detailed steps and repro files below. Crash log:

blender.exe         :0x00007FF6B12F8E00  rna_property_override_collection_subitem_name_index_lookup
blender.exe         :0x00007FF6B12F8900  rna_property_override_collection_subitem_lookup
blender.exe         :0x00007FF6B12F9D60  RNA_struct_override_apply
blender.exe         :0x00007FF6B0D70E70  BKE_lib_override_library_main_update
blender.exe         :0x00007FF6B0FDF460  blo_read_file_internal
blender.exe         :0x00007FF6B0FE0500  BLO_read_from_file
blender.exe         :0x00007FF6B0C12F20  BKE_blendfile_read
blender.exe         :0x00007FF6B0F79230  WM_file_read
blender.exe         :0x00007FF6B0F78690  wm_open_mainfile_exec
blender.exe         :0x00007FF6B0F94EC0  wm_operator_invoke
blender.exe         :0x00007FF6B0F944C0  wm_operator_call_internal
blender.exe         :0x00007FF6B0F8C6C0  WM_operator_name_call_ptr_with_depends_on_cursor
blender.exe         :0x00007FF6B194C840  ui_apply_but_funcs_after
blender.exe         :0x00007FF6B195CDC0  ui_popup_handler
blender.exe         :0x00007FF6B0F93570  wm_handlers_do_intern
blender.exe         :0x00007FF6B0F92760  wm_handlers_do
blender.exe         :0x00007FF6B0F8F120  wm_event_do_handlers
blender.exe         :0x00007FF6B0F771A0  WM_main
blender.exe         :0x00007FF6B09EA910  main

Exact steps for others to reproduce the error
I attached a few files

lib2.blend is the library file that gets linked. It just contains an object with one data-linked material.
scene.blend is a new blend file where I linked + library overrided the object+data.
scene_c.blend crashes on load. You can reach this configuration starting with scene.blend by following these steps:
- In the object's material slot, click on the 2 to make a single-user copy of the linked material
- Switch the material in this slot to the one called "Other"
- Change from data-linked to object-linked materials on this slot
- Save and reload the file

Technical Info
From what I can tell, the problem is uncovered in rna_mesh_gen.cc on the line rna_iterator_array_begin(iter, data->mat, sizeof(data->mat[0]), data->totcol, 0, nullptr);.

For some reason, data->mat is null here despite data->totcol correctly being 1.
A workaround for the crash, to recover broken files:

diff --git a/source/blender/makesrna/intern/rna_access_compare_override.cc b/source/blender/makesrna/intern/rna_access_compare_override.cc
index 58c4a03d9d0..467a2dc4809 100644
--- a/source/blender/makesrna/intern/rna_access_compare_override.cc
+++ b/source/blender/makesrna/intern/rna_access_compare_override.cc
@@ -1108,7 +1108,7 @@ static void rna_property_override_collection_subitem_name_index_lookup(
    */
   if (item_index != -1) {
     if (RNA_property_collection_lookup_int(ptr, prop, item_index, r_ptr_item_index)) {
-      if (item_name) {
+      if (item_name && r_ptr_item_index && r_ptr_item_index->type) {
         if (rna_property_override_collection_subitem_name_id_match(
                 item_name, item_name_len, do_id_pointer, item_id, r_ptr_item_index))
         {

This skips the index-based lookup and falls back to name-based lookup.

**System Information** Operating system: Windows-10-10.0.19044-SP0 64 Bits Graphics card: NVIDIA GeForce RTX 2080/PCIe/SSE2 NVIDIA Corporation 4.6.0 NVIDIA 531.68 **Blender Version** Broken: version: 4.0.0 Alpha, branch: main, commit date: 2023-08-10 03:47, hash: `4ad63687cbc4` Worked: version: 3.6.1 Release Candidate, branch: blender-v3.6-release, commit date: 2023-07-13 21:11, hash: `a8b82bd89e66` Bisect revealed a05419f18b is the first bad commit **Short description of error** I'm currently getting the same crash as reported in #110749 except I was able to reproduce it in a simple file! It crashes due to weird manipulation of the material slots of a library override object. You need to modify the object-linked AND data-linked material slots. Detailed steps and repro files below. Crash log: ``` blender.exe :0x00007FF6B12F8E00 rna_property_override_collection_subitem_name_index_lookup blender.exe :0x00007FF6B12F8900 rna_property_override_collection_subitem_lookup blender.exe :0x00007FF6B12F9D60 RNA_struct_override_apply blender.exe :0x00007FF6B0D70E70 BKE_lib_override_library_main_update blender.exe :0x00007FF6B0FDF460 blo_read_file_internal blender.exe :0x00007FF6B0FE0500 BLO_read_from_file blender.exe :0x00007FF6B0C12F20 BKE_blendfile_read blender.exe :0x00007FF6B0F79230 WM_file_read blender.exe :0x00007FF6B0F78690 wm_open_mainfile_exec blender.exe :0x00007FF6B0F94EC0 wm_operator_invoke blender.exe :0x00007FF6B0F944C0 wm_operator_call_internal blender.exe :0x00007FF6B0F8C6C0 WM_operator_name_call_ptr_with_depends_on_cursor blender.exe :0x00007FF6B194C840 ui_apply_but_funcs_after blender.exe :0x00007FF6B195CDC0 ui_popup_handler blender.exe :0x00007FF6B0F93570 wm_handlers_do_intern blender.exe :0x00007FF6B0F92760 wm_handlers_do blender.exe :0x00007FF6B0F8F120 wm_event_do_handlers blender.exe :0x00007FF6B0F771A0 WM_main blender.exe :0x00007FF6B09EA910 main ``` **Exact steps for others to reproduce the error** I attached a few files - lib2.blend is the library file that gets linked. It just contains an object with one data-linked material. - scene.blend is a new blend file where I linked + library overrided the object+data. - scene_c.blend crashes on load. You can reach this configuration starting with scene.blend by following these steps: - In the object's material slot, click on the `2` to make a single-user copy of the linked material - Switch the material in this slot to the one called "Other" - Change from data-linked to object-linked materials on this slot - Save and reload the file **Technical Info** From what I can tell, the problem is uncovered in `rna_mesh_gen.cc` on the line `rna_iterator_array_begin(iter, data->mat, sizeof(data->mat[0]), data->totcol, 0, nullptr);`. For some reason, `data->mat` is null here despite `data->totcol` correctly being 1. A workaround for the crash, to recover broken files: ```diff diff --git a/source/blender/makesrna/intern/rna_access_compare_override.cc b/source/blender/makesrna/intern/rna_access_compare_override.cc index 58c4a03d9d0..467a2dc4809 100644 --- a/source/blender/makesrna/intern/rna_access_compare_override.cc +++ b/source/blender/makesrna/intern/rna_access_compare_override.cc @@ -1108,7 +1108,7 @@ static void rna_property_override_collection_subitem_name_index_lookup( */ if (item_index != -1) { if (RNA_property_collection_lookup_int(ptr, prop, item_index, r_ptr_item_index)) { - if (item_name) { + if (item_name && r_ptr_item_index && r_ptr_item_index->type) { if (rna_property_override_collection_subitem_name_id_match( item_name, item_name_len, do_id_pointer, item_id, r_ptr_item_index)) { ``` This skips the index-based lookup and falls back to name-based lookup.

lib2.blend

921 KiB

scene_c.blend

863 KiB

scene.blend

862 KiB

RedMser added the