Right-click on StringProperty with search causes hard crash. #115431

New Issue

Owen-Lewery · 2023-11-26T03:44:57+01:00

Owen-Lewery commented

2023-11-26 03:44:57 +01:00

System Information
Operating system: macOS
Graphics card: Radeon Pro 560X

also on Linux (debian bookworm) with Blender 4.0.1 from snap

Blender Version
Broken: 3.6.0 to 4.0.1
Worked: 3.5.1

StringProperty props in operator using invoke_props_dialog causes hard crash when right-clicking on the field.

Provided blend file has a script creating an operator with a string prop that causes the error. By default connected to F1 in 3D View.

Run script
Press F1 in 3D view
Right-click on the text field.

I traced in a debug build of 4.0.1 here:

source/blender/editors/interface/interface_ops.cc:1695:

if (type == PROP_STRING) {
  const uiBut *but = UI_context_active_but_get(C);
  const uiButSearch *search_but = (but->type == UI_BTYPE_SEARCH_MENU) ? (uiButSearch *)but :
                                                                        nullptr;

...

UI_context_active_but_get(C) can return nullptr and in this case does. In the next line but->type unconditionally dereferences it.

(lldb) bt

thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 5.1
frame #0: 0x0000000101fe7b5a Blenderui_context_button_active(region=0x00007fa9cd863158, but_check_cb=0x0000000000000000)(uiBut const*)) at interface_handlers.cc:8865:24 frame #1: 0x0000000101fe7a61 BlenderUI_context_active_but_get(C=0x00006000038b83c8) at interface_handlers.cc:8897:10
- frame #2: 0x0000000102008854 Blenderjump_to_target_button(C=0x00006000038b83c8, poll=true) at interface_ops.cc:1696:26 frame #3: 0x000000010200870a Blenderui_jump_to_target_button_poll(C=0x00006000038b83c8) at interface_ops.cc:1731:10
  frame #4: 0x0000000101faffb1 Blenderui_popup_context_menu_for_button(C=0x00006000038b83c8, but=0x00007fa99f54b220, event=0x00006000038b37b8) at interface_context_menu.cc:1002:9 frame #5: 0x0000000101fd23db Blenderui_do_button(C=0x00006000038b83c8, block=0x00007fa99f54fa18, but=0x00007fa99f54b220, event=0x00006000038b37b8) at interface_handlers.cc:8062:11
  frame #6: 0x0000000101fcc68d Blenderui_handle_button_event(C=0x00006000038b83c8, event=0x00006000038b37b8, but=0x00007fa99f54b220) at interface_handlers.cc:9360:14 frame #7: 0x0000000101fcede6 Blenderui_handle_menu_button(C=0x00006000038b83c8, event=0x00006000038b37b8, menu=0x00007fa9bc108148) at interface_handlers.cc:10272:14
  frame #8: 0x0000000101fcbe63 Blenderui_handle_menus_recursive(C=0x00006000038b83c8, event=0x00006000038b37b8, menu=0x00007fa9bc108148, level=0, is_parent_inside=false, is_parent_menu=false, is_floating=true) at interface_handlers.cc:11429:16 frame #9: 0x0000000101fe8964 Blenderui_popup_handler(C=0x00006000038b83c8, event=0x00006000038b37b8, userdata=0x00007fa9bc108148) at interface_handlers.cc:11688:3
  frame #10: 0x000000010122db85 Blenderwm_handler_ui_call(C=0x00006000038b83c8, handler=0x0000600002dcaac8, event=0x00006000038b37b8, always_pass=false) at wm_event_system.cc:818:16 frame #11: 0x000000010122c887 Blenderwm_handlers_do_intern(C=0x00006000038b83c8, win=0x00007fa9cd852ce8, event=0x00006000038b37b8, handlers=0x00007fa9cd852e10) at wm_event_system.cc:3321:21
  frame #12: 0x000000010122b0c0 Blenderwm_handlers_do(C=0x00006000038b83c8, event=0x00006000038b37b8, handlers=0x00007fa9cd852e10) at wm_event_system.cc:3438:31 frame #13: 0x000000010122a5e2 Blenderwm_event_do_handlers(C=0x00006000038b83c8) at wm_event_system.cc:4065:17
  frame #14: 0x00000001012193e7 BlenderWM_main(C=0x00006000038b83c8) at wm.cc:609:5 frame #15: 0x00000001001875c3 Blendermain(argc=1, argv=0x00007ff7bfefd658) at creator.cc:590:5
  frame #16: 0x00007ff818ca63a6 dyld`start + 1942

(lldb) finish
2023-11-25 16:09:34.475669-0500 Blender[21107:7430565] [AMCP] 142595 HALC_ProxyIOContext.cpp:1327 HALC_ProxyIOContext::IOWorkLoop: skipping cycle due to overload
Process 21107 stopped

thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x24)
frame #0: 0x0000000102008862 Blender`jump_to_target_button(C=0x00006000038b83c8, poll=true) at interface_ops.cc:1697:50
1694 /* For string properties with prop_search, look up the search collection item. */
1695 if (type == PROP_STRING) {
1696 const uiBut *but = UI_context_active_but_get(C);
-> 1697 const uiButSearch *search_but = (but->type == UI_BTYPE_SEARCH_MENU) ? (uiButSearch *)but :
1698 nullptr;
1699
1700 if (search_but && search_but->items_update_fn == ui_rna_collection_search_update_fn) {
Target 0: (Blender) stopped.
(lldb) p uiBut
(lldb)

**System Information** Operating system: macOS Graphics card: Radeon Pro 560X also on Linux (debian bookworm) with Blender 4.0.1 from snap **Blender Version** Broken: 3.6.0 to 4.0.1 Worked: 3.5.1 StringProperty props in operator using invoke_props_dialog causes hard crash when right-clicking on the field. Provided blend file has a script creating an operator with a string prop that causes the error. By default connected to F1 in 3D View. 1. Run script 2. Press F1 in 3D view 3. Right-click on the text field. I traced in a debug build of 4.0.1 here: source/blender/editors/interface/interface_ops.cc:1695: if (type == PROP_STRING) { const uiBut *but = UI_context_active_but_get(C); const uiButSearch *search_but = (but->type == UI_BTYPE_SEARCH_MENU) ? (uiButSearch *)but : nullptr; ... UI_context_active_but_get(C) can return nullptr and in this case does. In the next line but->type unconditionally dereferences it. (lldb) bt * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 5.1 frame #0: 0x0000000101fe7b5a Blender`ui_context_button_active(region=0x00007fa9cd863158, but_check_cb=0x0000000000000000)(uiBut const*)) at interface_handlers.cc:8865:24 frame #1: 0x0000000101fe7a61 Blender`UI_context_active_but_get(C=0x00006000038b83c8) at interface_handlers.cc:8897:10 * frame #2: 0x0000000102008854 Blender`jump_to_target_button(C=0x00006000038b83c8, poll=true) at interface_ops.cc:1696:26 frame #3: 0x000000010200870a Blender`ui_jump_to_target_button_poll(C=0x00006000038b83c8) at interface_ops.cc:1731:10 frame #4: 0x0000000101faffb1 Blender`ui_popup_context_menu_for_button(C=0x00006000038b83c8, but=0x00007fa99f54b220, event=0x00006000038b37b8) at interface_context_menu.cc:1002:9 frame #5: 0x0000000101fd23db Blender`ui_do_button(C=0x00006000038b83c8, block=0x00007fa99f54fa18, but=0x00007fa99f54b220, event=0x00006000038b37b8) at interface_handlers.cc:8062:11 frame #6: 0x0000000101fcc68d Blender`ui_handle_button_event(C=0x00006000038b83c8, event=0x00006000038b37b8, but=0x00007fa99f54b220) at interface_handlers.cc:9360:14 frame #7: 0x0000000101fcede6 Blender`ui_handle_menu_button(C=0x00006000038b83c8, event=0x00006000038b37b8, menu=0x00007fa9bc108148) at interface_handlers.cc:10272:14 frame #8: 0x0000000101fcbe63 Blender`ui_handle_menus_recursive(C=0x00006000038b83c8, event=0x00006000038b37b8, menu=0x00007fa9bc108148, level=0, is_parent_inside=false, is_parent_menu=false, is_floating=true) at interface_handlers.cc:11429:16 frame #9: 0x0000000101fe8964 Blender`ui_popup_handler(C=0x00006000038b83c8, event=0x00006000038b37b8, userdata=0x00007fa9bc108148) at interface_handlers.cc:11688:3 frame #10: 0x000000010122db85 Blender`wm_handler_ui_call(C=0x00006000038b83c8, handler=0x0000600002dcaac8, event=0x00006000038b37b8, always_pass=false) at wm_event_system.cc:818:16 frame #11: 0x000000010122c887 Blender`wm_handlers_do_intern(C=0x00006000038b83c8, win=0x00007fa9cd852ce8, event=0x00006000038b37b8, handlers=0x00007fa9cd852e10) at wm_event_system.cc:3321:21 frame #12: 0x000000010122b0c0 Blender`wm_handlers_do(C=0x00006000038b83c8, event=0x00006000038b37b8, handlers=0x00007fa9cd852e10) at wm_event_system.cc:3438:31 frame #13: 0x000000010122a5e2 Blender`wm_event_do_handlers(C=0x00006000038b83c8) at wm_event_system.cc:4065:17 frame #14: 0x00000001012193e7 Blender`WM_main(C=0x00006000038b83c8) at wm.cc:609:5 frame #15: 0x00000001001875c3 Blender`main(argc=1, argv=0x00007ff7bfefd658) at creator.cc:590:5 frame #16: 0x00007ff818ca63a6 dyld`start + 1942 (lldb) finish 2023-11-25 16:09:34.475669-0500 Blender[21107:7430565] [AMCP] 142595 HALC_ProxyIOContext.cpp:1327 HALC_ProxyIOContext::IOWorkLoop: skipping cycle due to overload Process 21107 stopped * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x24) frame #0: 0x0000000102008862 Blender`jump_to_target_button(C=0x00006000038b83c8, poll=true) at interface_ops.cc:1697:50 1694 /* For string properties with prop_search, look up the search collection item. */ 1695 if (type == PROP_STRING) { 1696 const uiBut *but = UI_context_active_but_get(C); -> 1697 const uiButSearch *search_but = (but->type == UI_BTYPE_SEARCH_MENU) ? (uiButSearch *)but : 1698 nullptr; 1699 1700 if (search_but && search_but->items_update_fn == ui_rna_collection_search_update_fn) { Target 0: (Blender) stopped. (lldb) p uiBut (lldb)

errortest.blend

987 KiB

Owen-Lewery added the

labels 2023-11-26 03:44:58 +01:00

Jesse Yurkovich added

Module