Regression: Crash when loading with converted curves #112068

New Issue

jo · 2023-09-07T08:36:28+02:00

jo commented

2023-09-07 08:36:28 +02:00

System Information
Operating system: Win11
Graphics card: RTX 2060

Blender Version
Broken: (blender 3.6.0, blender 3.6.1, blender 3.6.2, blender 3.6.3 release candidate, blender 4.0 alpha)
Worked: (blender 3.5x)

Seems to be caused by 2788fa915b

Short description of error
after use "Object - Convert - Curves" on geometry curves hair, attributes with random letters show up (anonymous attributes?) -- this has been the case prior to 2788fa915b as well though. save the file and reload it would cause Blender to crash.
Prior to 2788fa915b, those attributes would have been gone after save/reload though

Exact steps for others to reproduce the error

on the default cube, Add > Curves > Fur
Object > Convert > Curves
save
revert
crash

Original report

download zipped version of blender 3.6 or above
on the default cube, add "Generate Hair Curves" node to create some curves.
use "Object - Convert - Curves" to convert to actual curves object and save blend file.
open a new blender and drag the saved blend file in. depends on the complex of curves, it would crash blender within a few times or instantly.

in the attached files, "1.blend" has one cube with the setup described above, without saving the file each time dragged in, it would crash blender in a few times.
"2.blend" has 16 cubes of the same setup and usually crash on the 2nd time
"3.blend" has complex geometry hair setup as show in pic 4, after convert to curves and save reload, it instantly crash blender on my PC

there are many ".a_xxxxxxx" attributes created after convert to curves as shown in pic 5. if remove them, blender works fine without crash.

if same setup done in Blender 3.5x and reload into Blender 3.5 or 3.6, no crash regardless of the attributes

**System Information** Operating system: Win11 Graphics card: RTX 2060 **Blender Version** Broken: (blender 3.6.0, blender 3.6.1, blender 3.6.2, blender 3.6.3 release candidate, blender 4.0 alpha) Worked: (blender 3.5x) Seems to be caused by 2788fa915b **Short description of error** after use "Object - Convert - Curves" on geometry curves hair, attributes with random letters show up (anonymous attributes?) -- this has been the case prior to 2788fa915b as well though. save the file and reload it would cause Blender to crash. Prior to 2788fa915b, those attributes would have been gone after save/reload though **Exact steps for others to reproduce the error** - on the default cube, `Add` > `Curves` > `Fur` - `Object` > `Convert` > `Curves` - save - revert - crash **Original report** 1. download zipped version of blender 3.6 or above 2. on the default cube, add "Generate Hair Curves" node to create some curves. 3. use "Object - Convert - Curves" to convert to actual curves object and save blend file. 4. open a new blender and drag the saved blend file in. depends on the complex of curves, it would crash blender within a few times or instantly. in the attached files, "1.blend" has one cube with the setup described above, without saving the file each time dragged in, it would crash blender in a few times. "2.blend" has 16 cubes of the same setup and usually crash on the 2nd time "3.blend" has complex geometry hair setup as show in pic 4, after convert to curves and save reload, it instantly crash blender on my PC there are many ".a_xxxxxxx" attributes created after convert to curves as shown in pic 5. if remove them, blender works fine without crash. if same setup done in Blender 3.5x and reload into Blender 3.5 or 3.6, no crash regardless of the attributes

5.jpg

179 KiB

1.blend

1.6 MiB

4.jpg

260 KiB

3.blend

9.5 MiB

2.blend

2.3 MiB

jo added the

labels 2023-09-07 08:36:29 +02:00

Philipp Oeser commented

2023-09-07 09:26:01 +02:00

Can confirm, will check

Philipp Oeser added

and removed

labels 2023-09-07 09:26:09 +02:00

Philipp Oeser commented

2023-09-07 11:00:24 +02:00

Seems to be caused by 2788fa915b

Are AnonymousAttribute saved now? Or have they always been (but discarded on read) ?
Reading them reveals they are garbage:

WARN (bke.customdata): source/blender/blenkernel/intern/customdata.cc:4323 CustomData_layer_ensure_data_exists: CustomDataLayer->data is NULL for type 0.

=================================================================
==772772==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61800078cb90 at pc 0x0000034a41f8 bp 0x7fffffffc5c0 sp 0x7fffffffc5b8
READ of size 4 at 0x61800078cb90 thread T0
    #0 0x34a41f7 in CustomData_blend_read blender/source/blender/blenkernel/intern/customdata.cc:5238
    #1 0x3366a94 in blender::bke::CurvesGeometry::blend_read(BlendDataReader&) blender/source/blender/blenkernel/intern/curves_geometry.cc:1468
    #2 0x333af5a in curves_blend_read_data blender/source/blender/blenkernel/intern/curves.cc:125
    #3 0x44afa66 in direct_link_id blender/source/blender/blenloader/intern/readfile.cc:2495
    #4 0x44b6a23 in read_libblock blender/source/blender/blenloader/intern/readfile.cc:3025
    #5 0x44c0307 in blo_read_file_internal(FileData*, char const*) blender/source/blender/blenloader/intern/readfile.cc:3665
    #6 0x44948d5 in BLO_read_from_file blender/source/blender/blenloader/intern/readblenentry.cc:414
    #7 0x91660a in BKE_blendfile_read blender/source/blender/blenkernel/intern/blendfile.cc:1014
    #8 0x42bbd38 in WM_file_read(bContext*, char const*, ReportList*) blender/source/blender/windowmanager/intern/wm_files.cc:1024
    #9 0x42c8aeb in wm_file_read_opwrap blender/source/blender/windowmanager/intern/wm_files.cc:2717
    #10 0x42cbd80 in wm_revert_mainfile_exec blender/source/blender/windowmanager/intern/wm_files.cc:3033
    #11 0x4270e68 in wm_operator_invoke blender/source/blender/windowmanager/intern/wm_event_system.cc:1542
    #12 0x4272557 in wm_operator_call_internal blender/source/blender/windowmanager/intern/wm_event_system.cc:1731
    #13 0x42727bc in WM_operator_name_call_ptr(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1779
    #14 0x4273cbf in WM_operator_name_call_ptr_with_depends_on_cursor(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*, char const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1968
    #15 0x77cbaf3 in ui_apply_but_funcs_after blender/source/blender/editors/interface/interface_handlers.cc:1038
    #16 0x785f70c in ui_popup_handler blender/source/blender/editors/interface/interface_handlers.cc:11654
    #17 0x42695d8 in wm_handler_ui_call blender/source/blender/windowmanager/intern/wm_event_system.cc:818
    #18 0x428943c in wm_handlers_do_intern blender/source/blender/windowmanager/intern/wm_event_system.cc:3314
    #19 0x428a7ed in wm_handlers_do blender/source/blender/windowmanager/intern/wm_event_system.cc:3431
    #20 0x4294d23 in wm_event_do_handlers(bContext*) blender/source/blender/windowmanager/intern/wm_event_system.cc:4058
    #21 0x4244345 in WM_main(bContext*) blender/source/blender/windowmanager/intern/wm.cc:609
    #22 0x8f26bd in main blender/source/creator/creator.cc:590
    #23 0x7fffedc49b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
    #24 0x7fffedc49c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
    #25 0x8f1a14 in _start (build_linux_debug/bin/blender+0x8f1a14) (BuildId: 733cf66a03e59e6b2742c770a77a3aa75ddea241)

0x61800078cb90 is located 8 bytes after 776-byte region [0x61800078c880,0x61800078cb88)
allocated by thread T0 here:
    #0 0x7ffff78d92ef in malloc (/lib64/libasan.so.8+0xd92ef) (BuildId: e5f0a0d511a659fbc47bf41072869139cb2db47f)
    #1 0x4232830 in MEM_lockfree_mallocN blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:249
    #2 0x44a90f9 in read_struct blender/source/blender/blenloader/intern/readfile.cc:1810
    #3 0x44afd14 in read_data_into_datamap blender/source/blender/blenloader/intern/readfile.cc:2549
    #4 0x44b69d1 in read_libblock blender/source/blender/blenloader/intern/readfile.cc:3024
    #5 0x44c0307 in blo_read_file_internal(FileData*, char const*) blender/source/blender/blenloader/intern/readfile.cc:3665
    #6 0x44948d5 in BLO_read_from_file blender/source/blender/blenloader/intern/readblenentry.cc:414
    #7 0x91660a in BKE_blendfile_read blender/source/blender/blenkernel/intern/blendfile.cc:1014
    #8 0x42bbd38 in WM_file_read(bContext*, char const*, ReportList*) blender/source/blender/windowmanager/intern/wm_files.cc:1024
    #9 0x42c8aeb in wm_file_read_opwrap blender/source/blender/windowmanager/intern/wm_files.cc:2717
    #10 0x42cbd80 in wm_revert_mainfile_exec blender/source/blender/windowmanager/intern/wm_files.cc:3033
    #11 0x4270e68 in wm_operator_invoke blender/source/blender/windowmanager/intern/wm_event_system.cc:1542
    #12 0x4272557 in wm_operator_call_internal blender/source/blender/windowmanager/intern/wm_event_system.cc:1731
    #13 0x42727bc in WM_operator_name_call_ptr(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1779
    #14 0x4273cbf in WM_operator_name_call_ptr_with_depends_on_cursor(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*, char const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1968
    #15 0x77cbaf3 in ui_apply_but_funcs_after blender/source/blender/editors/interface/interface_handlers.cc:1038
    #16 0x785f70c in ui_popup_handler blender/source/blender/editors/interface/interface_handlers.cc:11654
    #17 0x42695d8 in wm_handler_ui_call blender/source/blender/windowmanager/intern/wm_event_system.cc:818
    #18 0x428943c in wm_handlers_do_intern blender/source/blender/windowmanager/intern/wm_event_system.cc:3314
    #19 0x428a7ed in wm_handlers_do blender/source/blender/windowmanager/intern/wm_event_system.cc:3431
    #20 0x4294d23 in wm_event_do_handlers(bContext*) blender/source/blender/windowmanager/intern/wm_event_system.cc:4058
    #21 0x4244345 in WM_main(bContext*) blender/source/blender/windowmanager/intern/wm.cc:609
    #22 0x8f26bd in main blender/source/creator/creator.cc:590
    #23 0x7fffedc49b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
    #24 0x7fffedc49c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9)
    #25 0x8f1a14 in _start (build_linux_debug/bin/blender+0x8f1a14) (BuildId: 733cf66a03e59e6b2742c770a77a3aa75ddea241)

SUMMARY: AddressSanitizer: heap-buffer-overflow blender/source/blender/blenkernel/intern/customdata.cc:5238 in CustomData_blend_read
Shadow bytes around the buggy address:
  0x61800078c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078c980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078ca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078cb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x61800078cb80: 00 fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x61800078cc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x61800078cc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x61800078ce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==772772==ABORTING

CC @filedescriptor

Seems to be caused by 2788fa915be6a7da0a0b0ad63626c095eef1e216 Are AnonymousAttribute saved now? Or have they always been (but discarded on read) ? Reading them reveals they are garbage: `WARN (bke.customdata): source/blender/blenkernel/intern/customdata.cc:4323 CustomData_layer_ensure_data_exists: CustomDataLayer->data is NULL for type 0.` ``` ================================================================= ==772772==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61800078cb90 at pc 0x0000034a41f8 bp 0x7fffffffc5c0 sp 0x7fffffffc5b8 READ of size 4 at 0x61800078cb90 thread T0 #0 0x34a41f7 in CustomData_blend_read blender/source/blender/blenkernel/intern/customdata.cc:5238 #1 0x3366a94 in blender::bke::CurvesGeometry::blend_read(BlendDataReader&) blender/source/blender/blenkernel/intern/curves_geometry.cc:1468 #2 0x333af5a in curves_blend_read_data blender/source/blender/blenkernel/intern/curves.cc:125 #3 0x44afa66 in direct_link_id blender/source/blender/blenloader/intern/readfile.cc:2495 #4 0x44b6a23 in read_libblock blender/source/blender/blenloader/intern/readfile.cc:3025 #5 0x44c0307 in blo_read_file_internal(FileData*, char const*) blender/source/blender/blenloader/intern/readfile.cc:3665 #6 0x44948d5 in BLO_read_from_file blender/source/blender/blenloader/intern/readblenentry.cc:414 #7 0x91660a in BKE_blendfile_read blender/source/blender/blenkernel/intern/blendfile.cc:1014 #8 0x42bbd38 in WM_file_read(bContext*, char const*, ReportList*) blender/source/blender/windowmanager/intern/wm_files.cc:1024 #9 0x42c8aeb in wm_file_read_opwrap blender/source/blender/windowmanager/intern/wm_files.cc:2717 #10 0x42cbd80 in wm_revert_mainfile_exec blender/source/blender/windowmanager/intern/wm_files.cc:3033 #11 0x4270e68 in wm_operator_invoke blender/source/blender/windowmanager/intern/wm_event_system.cc:1542 #12 0x4272557 in wm_operator_call_internal blender/source/blender/windowmanager/intern/wm_event_system.cc:1731 #13 0x42727bc in WM_operator_name_call_ptr(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1779 #14 0x4273cbf in WM_operator_name_call_ptr_with_depends_on_cursor(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*, char const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1968 #15 0x77cbaf3 in ui_apply_but_funcs_after blender/source/blender/editors/interface/interface_handlers.cc:1038 #16 0x785f70c in ui_popup_handler blender/source/blender/editors/interface/interface_handlers.cc:11654 #17 0x42695d8 in wm_handler_ui_call blender/source/blender/windowmanager/intern/wm_event_system.cc:818 #18 0x428943c in wm_handlers_do_intern blender/source/blender/windowmanager/intern/wm_event_system.cc:3314 #19 0x428a7ed in wm_handlers_do blender/source/blender/windowmanager/intern/wm_event_system.cc:3431 #20 0x4294d23 in wm_event_do_handlers(bContext*) blender/source/blender/windowmanager/intern/wm_event_system.cc:4058 #21 0x4244345 in WM_main(bContext*) blender/source/blender/windowmanager/intern/wm.cc:609 #22 0x8f26bd in main blender/source/creator/creator.cc:590 #23 0x7fffedc49b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9) #24 0x7fffedc49c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9) #25 0x8f1a14 in _start (build_linux_debug/bin/blender+0x8f1a14) (BuildId: 733cf66a03e59e6b2742c770a77a3aa75ddea241) 0x61800078cb90 is located 8 bytes after 776-byte region [0x61800078c880,0x61800078cb88) allocated by thread T0 here: #0 0x7ffff78d92ef in malloc (/lib64/libasan.so.8+0xd92ef) (BuildId: e5f0a0d511a659fbc47bf41072869139cb2db47f) #1 0x4232830 in MEM_lockfree_mallocN blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:249 #2 0x44a90f9 in read_struct blender/source/blender/blenloader/intern/readfile.cc:1810 #3 0x44afd14 in read_data_into_datamap blender/source/blender/blenloader/intern/readfile.cc:2549 #4 0x44b69d1 in read_libblock blender/source/blender/blenloader/intern/readfile.cc:3024 #5 0x44c0307 in blo_read_file_internal(FileData*, char const*) blender/source/blender/blenloader/intern/readfile.cc:3665 #6 0x44948d5 in BLO_read_from_file blender/source/blender/blenloader/intern/readblenentry.cc:414 #7 0x91660a in BKE_blendfile_read blender/source/blender/blenkernel/intern/blendfile.cc:1014 #8 0x42bbd38 in WM_file_read(bContext*, char const*, ReportList*) blender/source/blender/windowmanager/intern/wm_files.cc:1024 #9 0x42c8aeb in wm_file_read_opwrap blender/source/blender/windowmanager/intern/wm_files.cc:2717 #10 0x42cbd80 in wm_revert_mainfile_exec blender/source/blender/windowmanager/intern/wm_files.cc:3033 #11 0x4270e68 in wm_operator_invoke blender/source/blender/windowmanager/intern/wm_event_system.cc:1542 #12 0x4272557 in wm_operator_call_internal blender/source/blender/windowmanager/intern/wm_event_system.cc:1731 #13 0x42727bc in WM_operator_name_call_ptr(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1779 #14 0x4273cbf in WM_operator_name_call_ptr_with_depends_on_cursor(bContext*, wmOperatorType*, wmOperatorCallContext, PointerRNA*, wmEvent const*, char const*) blender/source/blender/windowmanager/intern/wm_event_system.cc:1968 #15 0x77cbaf3 in ui_apply_but_funcs_after blender/source/blender/editors/interface/interface_handlers.cc:1038 #16 0x785f70c in ui_popup_handler blender/source/blender/editors/interface/interface_handlers.cc:11654 #17 0x42695d8 in wm_handler_ui_call blender/source/blender/windowmanager/intern/wm_event_system.cc:818 #18 0x428943c in wm_handlers_do_intern blender/source/blender/windowmanager/intern/wm_event_system.cc:3314 #19 0x428a7ed in wm_handlers_do blender/source/blender/windowmanager/intern/wm_event_system.cc:3431 #20 0x4294d23 in wm_event_do_handlers(bContext*) blender/source/blender/windowmanager/intern/wm_event_system.cc:4058 #21 0x4244345 in WM_main(bContext*) blender/source/blender/windowmanager/intern/wm.cc:609 #22 0x8f26bd in main blender/source/creator/creator.cc:590 #23 0x7fffedc49b49 in __libc_start_call_main (/lib64/libc.so.6+0x27b49) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9) #24 0x7fffedc49c0a in __libc_start_main_alias_2 (/lib64/libc.so.6+0x27c0a) (BuildId: 245240a31888ad5c11bbc55b18e02d87388f59a9) #25 0x8f1a14 in _start (build_linux_debug/bin/blender+0x8f1a14) (BuildId: 733cf66a03e59e6b2742c770a77a3aa75ddea241) SUMMARY: AddressSanitizer: heap-buffer-overflow blender/source/blender/blenkernel/intern/customdata.cc:5238 in CustomData_blend_read Shadow bytes around the buggy address: 0x61800078c900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078c980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078ca00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078ca80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078cb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x61800078cb80: 00 fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa 0x61800078cc00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x61800078cc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078cd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078cd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x61800078ce00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==772772==ABORTING ``` CC @filedescriptor

Philipp Oeser added

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Regression: Crash when loading with converted curves #112068