Adding Point Density Texture to World Color Crashes Blender #45649

New Issue

Aaron Carlisle · 2015-08-01T22:29:40+02:00

Aaron Carlisle commented

2015-08-01 22:29:40 +02:00

System Information
Windows 8.0
Intel HD 4600

Blender Version
Broken: Latest Master
Worked: N/A

Short description of error
Adding Point Density texture to world color crashes Blender

Crash is not 100% reliable so try repeating a couple times

Exact steps for others to reproduce the error
Add point density texture to world color via the properties panel (did not try node editor)

If no crash add a different texture and repeat first step

**System Information** Windows 8.0 Intel HD 4600 **Blender Version** Broken: Latest Master Worked: N/A **Short description of error** Adding Point Density texture to world color crashes Blender Crash is not 100% reliable so try repeating a couple times **Exact steps for others to reproduce the error** Add point density texture to world color via the properties panel (did not try node editor) *If no crash add a different texture and repeat first step*

Aaron Carlisle commented

2015-08-01 22:29:40 +02:00

Changed status to: 'Open'

Sergey Sharybin was assigned by Aaron Carlisle

2015-08-01 22:29:40 +02:00

Aaron Carlisle commented

2015-08-01 22:29:40 +02:00

Added subscriber: @Blendify

Kévin Dietrich commented

2015-08-02 07:51:12 +02:00

Added subscriber: @kevindietrich

Kévin Dietrich commented

2015-08-02 07:51:13 +02:00

I can confirm there is a crash when first adding a point density texture and then switching to a different texture, in the properties panel. But nothing happens when just adding a point density texture over and over agin.

This seems to fix it (but I'm not sure what I'm doing ;):

diff --git a/source/blender/makesdna/DNA_node_types.h b/source/blender/makesdna/DNA_node_types.h
index 17b0dbc..32f766e 100644
--- a/source/blender/makesdna/DNA_node_types.h
+++ b/source/blender/makesdna/DNA_node_types.h
@@ -795,6 +795,7 @@ typedef struct NodeShaderVectTransform {
 } NodeShaderVectTransform;
 
 typedef struct NodeShaderTexPointDensity {
+	NodeTexBase base;
 	short point_source, pad;
 	int particle_system;
 	float radius;

lines=5
==21926==ERROR: AddressSanitizer: unknown-crash on address 0x603000147468 at pc 0x122edb1 bp 0x7fffffffd880 sp 0x7fffffffd878
READ of size 968 at 0x603000147468 thread T0
    - 0 0x122edb0 in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:51
    - 1 0x122edb0 in node_socket_add_replace /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:271
    - 2 0x122efc9 in ui_node_link /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:383
    - 3 0x1558978 in ui_apply_but_funcs_after /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:744
    - 4 0x157a97f in ui_handler_region_menu /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:9757
    - 5 0x10e096b in wm_handler_ui_call /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:453
    - 6 0x10e8d39 in wm_handlers_do_intern /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2016
    - 7 0x10e91ce in wm_handlers_do /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2100
    - 8 0x10e9aff in wm_event_do_handlers /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2383
    - 9 0x10d21da in WM_main /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm.c:487
    - 10 0x10d05b1 in main /home/kevin/src/blender-git/blender/source/creator/creator.c:1929
    - 11 0x7ffff2890ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #12 0x10cb358 (/home/kevin/src/blender-git/build_linux_debug/bin/blender+0x10cb358)

0x603000147480 is located 0 bytes to the right of 32-byte region [0x603000147460,0x603000147480)
allocated by thread T0 here:
    - 0 0x7ffff6f56925 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54925)
    - 1 0x289ac45 in MEM_lockfree_callocN /home/kevin/src/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286
    - 2 0x221659f in node_shader_init_tex_pointdensity /home/kevin/src/blender-git/blender/source/blender/nodes/shader/nodes/node_shader_tex_pointdensity.c:46
    - 3 0x203bb84 in node_init /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:136
    - 4 0x203bf0d in node_set_typeinfo /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:189
    - 5 0x203c28e in nodeAddNode /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:866
    - 6 0x203c40f in nodeAddStaticNode /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:890
    - 7 0x122e5b7 in node_socket_add_replace /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:217
    - 8 0x122efc9 in ui_node_link /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:383
    - 9 0x1558978 in ui_apply_but_funcs_after /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:744
    - 10 0x157a97f in ui_handler_region_menu /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:9757
    - 11 0x10e096b in wm_handler_ui_call /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:453
    - 12 0x10e8d39 in wm_handlers_do_intern /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2016
    - 13 0x10e91ce in wm_handlers_do /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2100
    - 14 0x10e9aff in wm_event_do_handlers /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2383
    - 15 0x10d21da in WM_main /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm.c:487
    - 16 0x10d05b1 in main /home/kevin/src/blender-git/blender/source/creator/creator.c:1929
    - 17 0x7ffff2890ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)

SUMMARY: AddressSanitizer: unknown-crash /usr/include/x86_64-linux-gnu/bits/string3.h:51 memcpy
Shadow bytes around the buggy address:
  0x0c0680020e30: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c0680020e40: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
  0x0c0680020e50: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
  0x0c0680020e60: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
  0x0c0680020e70: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
=>0x0c0680020e80: fd fd fd fa fa fa fd fd fd fa fa fa 00[00]00 00
  0x0c0680020e90: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00
  0x0c0680020ea0: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa
  0x0c0680020eb0: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fa
  0x0c0680020ec0: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd
  0x0c0680020ed0: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Contiguous container OOB:fc
  ASan internal:           fe
==21926==ABORTING
[Thread 0x7fffc91a3700 (LWP 21942) exited]
[Thread 0x7fffc235d700 (LWP 21952) exited]
[Thread 0x7fffc4472700 (LWP 21949) exited]
[Thread 0x7fffc1856700 (LWP 21953) exited]
[Thread 0x7fffc2e64700 (LWP 21951) exited]
[Thread 0x7fffc396b700 (LWP 21950) exited]
[Thread 0x7fffc4f79700 (LWP 21948) exited]
[Thread 0x7fffc5a80700 (LWP 21947) exited]
[Thread 0x7fffc6587700 (LWP 21946) exited]
[Thread 0x7fffc708e700 (LWP 21945) exited]
[Thread 0x7fffc7b95700 (LWP 21944) exited]
[Thread 0x7fffc869c700 (LWP 21943) exited]
[Thread 0x7fffc99a4700 (LWP 21941) exited]
[Thread 0x7fffe314c700 (LWP 21940) exited]
[Thread 0x7fffd247f700 (LWP 21937) exited]
[Thread 0x7fffd51c7700 (LWP 21934) exited]
[Thread 0x7fffd5cce700 (LWP 21933) exited]
[Thread 0x7fffd67d5700 (LWP 21932) exited]
[Thread 0x7fffd72dc700 (LWP 21931) exited]
[Thread 0x7fffd7de3700 (LWP 21930) exited]
[Thread 0x7fffd88ea700 (LWP 21929) exited]
[Thread 0x7fffd93f1700 (LWP 21928) exited]
[Thread 0x7fffe85fa700 (LWP 21927) exited]
[Thread 0x7ffff7fbb880 (LWP 21926) exited]

I can confirm there is a crash when first adding a point density texture and then switching to a different texture, in the properties panel. But nothing happens when just adding a point density texture over and over agin. This seems to fix it (but I'm not sure what I'm doing ;): ``` diff --git a/source/blender/makesdna/DNA_node_types.h b/source/blender/makesdna/DNA_node_types.h index 17b0dbc..32f766e 100644 --- a/source/blender/makesdna/DNA_node_types.h +++ b/source/blender/makesdna/DNA_node_types.h @@ -795,6 +795,7 @@ typedef struct NodeShaderVectTransform { } NodeShaderVectTransform; typedef struct NodeShaderTexPointDensity { + NodeTexBase base; short point_source, pad; int particle_system; float radius; ``` ------- ``` lines=5 ==21926==ERROR: AddressSanitizer: unknown-crash on address 0x603000147468 at pc 0x122edb1 bp 0x7fffffffd880 sp 0x7fffffffd878 READ of size 968 at 0x603000147468 thread T0 - 0 0x122edb0 in memcpy /usr/include/x86_64-linux-gnu/bits/string3.h:51 - 1 0x122edb0 in node_socket_add_replace /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:271 - 2 0x122efc9 in ui_node_link /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:383 - 3 0x1558978 in ui_apply_but_funcs_after /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:744 - 4 0x157a97f in ui_handler_region_menu /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:9757 - 5 0x10e096b in wm_handler_ui_call /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:453 - 6 0x10e8d39 in wm_handlers_do_intern /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2016 - 7 0x10e91ce in wm_handlers_do /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2100 - 8 0x10e9aff in wm_event_do_handlers /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2383 - 9 0x10d21da in WM_main /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm.c:487 - 10 0x10d05b1 in main /home/kevin/src/blender-git/blender/source/creator/creator.c:1929 - 11 0x7ffff2890ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) #12 0x10cb358 (/home/kevin/src/blender-git/build_linux_debug/bin/blender+0x10cb358) 0x603000147480 is located 0 bytes to the right of 32-byte region [0x603000147460,0x603000147480) allocated by thread T0 here: - 0 0x7ffff6f56925 in __interceptor_calloc (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x54925) - 1 0x289ac45 in MEM_lockfree_callocN /home/kevin/src/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286 - 2 0x221659f in node_shader_init_tex_pointdensity /home/kevin/src/blender-git/blender/source/blender/nodes/shader/nodes/node_shader_tex_pointdensity.c:46 - 3 0x203bb84 in node_init /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:136 - 4 0x203bf0d in node_set_typeinfo /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:189 - 5 0x203c28e in nodeAddNode /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:866 - 6 0x203c40f in nodeAddStaticNode /home/kevin/src/blender-git/blender/source/blender/blenkernel/intern/node.c:890 - 7 0x122e5b7 in node_socket_add_replace /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:217 - 8 0x122efc9 in ui_node_link /home/kevin/src/blender-git/blender/source/blender/editors/space_node/node_templates.c:383 - 9 0x1558978 in ui_apply_but_funcs_after /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:744 - 10 0x157a97f in ui_handler_region_menu /home/kevin/src/blender-git/blender/source/blender/editors/interface/interface_handlers.c:9757 - 11 0x10e096b in wm_handler_ui_call /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:453 - 12 0x10e8d39 in wm_handlers_do_intern /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2016 - 13 0x10e91ce in wm_handlers_do /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2100 - 14 0x10e9aff in wm_event_do_handlers /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2383 - 15 0x10d21da in WM_main /home/kevin/src/blender-git/blender/source/blender/windowmanager/intern/wm.c:487 - 16 0x10d05b1 in main /home/kevin/src/blender-git/blender/source/creator/creator.c:1929 - 17 0x7ffff2890ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4) SUMMARY: AddressSanitizer: unknown-crash /usr/include/x86_64-linux-gnu/bits/string3.h:51 memcpy Shadow bytes around the buggy address: 0x0c0680020e30: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x0c0680020e40: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa 0x0c0680020e50: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa 0x0c0680020e60: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd 0x0c0680020e70: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa =>0x0c0680020e80: fd fd fd fa fa fa fd fd fd fa fa fa 00[00]00 00 0x0c0680020e90: fa fa 00 00 00 fa fa fa 00 00 00 fa fa fa 00 00 0x0c0680020ea0: 00 00 fa fa fd fd fd fd fa fa fd fd fd fd fa fa 0x0c0680020eb0: fd fd fd fa fa fa fd fd fd fd fa fa fd fd fd fa 0x0c0680020ec0: fa fa fd fd fd fd fa fa fd fd fd fa fa fa fd fd 0x0c0680020ed0: fd fd fa fa fd fd fd fa fa fa fd fd fd fd fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Contiguous container OOB:fc ASan internal: fe ==21926==ABORTING [Thread 0x7fffc91a3700 (LWP 21942) exited] [Thread 0x7fffc235d700 (LWP 21952) exited] [Thread 0x7fffc4472700 (LWP 21949) exited] [Thread 0x7fffc1856700 (LWP 21953) exited] [Thread 0x7fffc2e64700 (LWP 21951) exited] [Thread 0x7fffc396b700 (LWP 21950) exited] [Thread 0x7fffc4f79700 (LWP 21948) exited] [Thread 0x7fffc5a80700 (LWP 21947) exited] [Thread 0x7fffc6587700 (LWP 21946) exited] [Thread 0x7fffc708e700 (LWP 21945) exited] [Thread 0x7fffc7b95700 (LWP 21944) exited] [Thread 0x7fffc869c700 (LWP 21943) exited] [Thread 0x7fffc99a4700 (LWP 21941) exited] [Thread 0x7fffe314c700 (LWP 21940) exited] [Thread 0x7fffd247f700 (LWP 21937) exited] [Thread 0x7fffd51c7700 (LWP 21934) exited] [Thread 0x7fffd5cce700 (LWP 21933) exited] [Thread 0x7fffd67d5700 (LWP 21932) exited] [Thread 0x7fffd72dc700 (LWP 21931) exited] [Thread 0x7fffd7de3700 (LWP 21930) exited] [Thread 0x7fffd88ea700 (LWP 21929) exited] [Thread 0x7fffd93f1700 (LWP 21928) exited] [Thread 0x7fffe85fa700 (LWP 21927) exited] [Thread 0x7ffff7fbb880 (LWP 21926) exited] ```

Thomas Dinges commented

2015-08-02 23:34:42 +02:00

Added subscriber: @ThomasDinges