Changing Auto-IK length crashes Blender (with new-depsgraph) #51955

New Issue

¿? · 2017-07-02T11:37:42+02:00

¿? commented

2017-07-02 11:37:42 +02:00

Windows 7 64-bit, GTX 770 OC

Blender 2.78/daily/2.8
b796ce0

When changing the Auto-IK length (Ctrl+wheel) from the Default 0 value, movement is disabled (while it remains > 0).
If you exit/stop the translation (left/right-click/esc), then try to move a bone again while auto-IK is enabled, Blender will crash.

I believe what's happening is new-depsgraph doesn't handle auto-Ik length correctly because it only crashes if you stopped while the length was still greater than 0. (it will also crash if the bones stopped responding even when len is set to 0)

Since 2.8 currently uses new depsgraph by default, it happens as-is. I'm running the 2.78/2.79 daily build with --enable-new-depsgraph

Windows 7 64-bit, GTX 770 OC Blender 2.78/daily/2.8 b796ce0 When changing the Auto-IK length (Ctrl+wheel) from the Default 0 value, movement is disabled (while it remains > 0). If you exit/stop the translation (left/right-click/esc), then try to move a bone again while auto-IK is enabled, Blender will crash. I believe what's happening is new-depsgraph doesn't handle auto-Ik length correctly because it only crashes if you stopped while the length was still greater than 0. (it will also crash if the bones stopped responding even when len is set to 0) Since 2.8 currently uses new depsgraph by default, it happens as-is. I'm running the 2.78/2.79 daily build with --enable-new-depsgraph

¿? commented

2017-07-02 11:37:42 +02:00

Changed status to: 'Open'

¿? commented

2017-07-02 11:37:42 +02:00

Added subscriber: @Ebone

Luca Rood commented

2017-07-03 16:35:30 +02:00

Added subscriber: @LucaRood-3

Sergey Sharybin was assigned by Luca Rood

2017-07-03 16:35:30 +02:00

Luca Rood commented

2017-07-03 16:35:30 +02:00

Can confirm. With new DEG, bone motion freezes when changing the IK length, and second attempt at moving causes crash.

Here is the ASAN log:

lines=15
=================================================================
==5733==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00008b858 at pc 0x55fc87adc21c bp 0x7ffcda967f20 sp 0x7ffcda967f18
READ of size 8 at 0x60c00008b858 thread T0
    - 0 0x55fc87adc21b in execute_posetree /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:374
    - 1 0x55fc87ade0da in iksolver_execute_tree /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:561
    - 2 0x55fc87ad7fd6 in BIK_execute_tree /home/guest/src/blender/source/blender/ikplugin/intern/ikplugin_api.c:105
    - 3 0x55fc8842bcdc in BKE_pose_iktree_evaluate /home/guest/src/blender/source/blender/blenkernel/intern/armature_update.c:669
    - 4 0x55fc89145430 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)>::__call<void, EvaluationContext*&&, 0ul, 1ul, 2ul, 3ul>(std::tuple<EvaluationContext*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/6/functional:934
    - 5 0x55fc89144adc in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)>::operator()<EvaluationContext*, void>(EvaluationContext*&&) /usr/include/c++/6/functional:993
    - 6 0x55fc8914407b in std::_Function_handler<void (EvaluationContext*), std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)> >::_M_invoke(std::_Any_data const&, EvaluationContext*&&) /usr/include/c++/6/functional:1731
    - 7 0x55fc89158368 in std::function<void (EvaluationContext*)>::operator()(EvaluationContext*) const /usr/include/c++/6/functional:2127
    - 8 0x55fc891570de in deg_task_run_func /home/guest/src/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    - 9 0x55fc89111bbf in handle_local_queue /home/guest/src/blender/source/blender/blenlib/intern/task.c:418
    - 10 0x55fc89111bbf in BLI_task_pool_work_and_wait /home/guest/src/blender/source/blender/blenlib/intern/task.c:899
    - 11 0x55fc89158220 in DEG::deg_evaluate_on_refresh(EvaluationContext*, DEG::Depsgraph*, unsigned int) /home/guest/src/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:348
    - 12 0x55fc8912fc61 in DEG_evaluate_on_refresh /home/guest/src/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:137
    - 13 0x55fc888ba047 in BKE_scene_update_tagged /home/guest/src/blender/source/blender/blenkernel/intern/scene.c:1839
    - 14 0x55fc86591dca in wm_event_do_notifiers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:404
    - 15 0x55fc8658023f in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:507
    - 16 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527
    - 17 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)
    #18 0x55fc86575a99 in _start (/home/guest/src/build_debug/bin/blender+0x2595a99)

0x60c00008b858 is located 24 bytes inside of 128-byte region [0x60c00008b840,0x60c00008b8c0)
freed by thread T0 here:
    - 0 0x7f7525893a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10)
    - 1 0x55fc894b75b2 in MEM_lockfree_freeN /home/guest/src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:169
    - 2 0x55fc86a2fc14 in pose_grab_with_ik_clear /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:855
    - 3 0x55fc86a720b0 in special_aftertrans_update /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:6389
    - 4 0x55fc869bdb31 in transformEnd /home/guest/src/blender/source/blender/editors/transform/transform.c:2437
    - 5 0x55fc86aa6263 in transform_modal /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:414
    - 6 0x55fc865998f2 in wm_handler_operator_call /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1701
    - 7 0x55fc8659bc9d in wm_handlers_do_intern /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2119
    - 8 0x55fc8659bde3 in wm_handlers_do /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2158
    - 9 0x55fc8659d621 in wm_event_do_handlers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2431
    - 10 0x55fc86580233 in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:504
    - 11 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527
    #12 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

previously allocated by thread T0 here:
    - 0 0x7f7525893ed0 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1ed0)
    - 1 0x55fc894b7ab8 in MEM_lockfree_callocN /home/guest/src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286
    - 2 0x55fc884de676 in add_new_constraint_internal /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4606
    - 3 0x55fc884de979 in add_new_constraint /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4647
    - 4 0x55fc884deb36 in BKE_constraint_add_for_pose /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4696
    - 5 0x55fc86a303c0 in pose_grab_with_ik_add /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:918
    - 6 0x55fc86a30f39 in pose_grab_with_ik /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:1011
    - 7 0x55fc86a312ac in createTransPose /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:1062
    - 8 0x55fc86a8087e in createTransData /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:8151
    - 9 0x55fc869bc0df in initTransform /home/guest/src/blender/source/blender/editors/transform/transform.c:2131
    - 10 0x55fc86aa5f75 in transformops_data /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:367
    - 11 0x55fc86aa66b1 in transform_invoke /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:481
    - 12 0x55fc86596576 in wm_operator_invoke /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1115
    - 13 0x55fc86599d9d in wm_handler_operator_call /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1767
    - 14 0x55fc8659b5e0 in wm_handlers_do_intern /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2047
    - 15 0x55fc8659bde3 in wm_handlers_do /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2158
    - 16 0x55fc8659db7a in wm_event_do_handlers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2493
    - 17 0x55fc86580233 in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:504
    - 18 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527
    - 19 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0)

SUMMARY: AddressSanitizer: heap-use-after-free /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:374 in execute_posetree
Shadow bytes around the buggy address:
  0x0c18800096b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c18800096c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c18800096d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c18800096e0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c18800096f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1880009700: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd
  0x0c1880009710: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1880009720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c1880009730: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c1880009740: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa
  0x0c1880009750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==5733==ABORTING

Can confirm. With new DEG, bone motion freezes when changing the IK length, and second attempt at moving causes crash. Here is the ASAN log: ``` lines=15 ================================================================= ==5733==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00008b858 at pc 0x55fc87adc21c bp 0x7ffcda967f20 sp 0x7ffcda967f18 READ of size 8 at 0x60c00008b858 thread T0 - 0 0x55fc87adc21b in execute_posetree /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:374 - 1 0x55fc87ade0da in iksolver_execute_tree /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:561 - 2 0x55fc87ad7fd6 in BIK_execute_tree /home/guest/src/blender/source/blender/ikplugin/intern/ikplugin_api.c:105 - 3 0x55fc8842bcdc in BKE_pose_iktree_evaluate /home/guest/src/blender/source/blender/blenkernel/intern/armature_update.c:669 - 4 0x55fc89145430 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)>::__call<void, EvaluationContext*&&, 0ul, 1ul, 2ul, 3ul>(std::tuple<EvaluationContext*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul, 3ul>) /usr/include/c++/6/functional:934 - 5 0x55fc89144adc in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)>::operator()<EvaluationContext*, void>(EvaluationContext*&&) /usr/include/c++/6/functional:993 - 6 0x55fc8914407b in std::_Function_handler<void (EvaluationContext*), std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*, bPoseChannel*))(EvaluationContext*, Scene*, Object*, bPoseChannel*)> >::_M_invoke(std::_Any_data const&, EvaluationContext*&&) /usr/include/c++/6/functional:1731 - 7 0x55fc89158368 in std::function<void (EvaluationContext*)>::operator()(EvaluationContext*) const /usr/include/c++/6/functional:2127 - 8 0x55fc891570de in deg_task_run_func /home/guest/src/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 - 9 0x55fc89111bbf in handle_local_queue /home/guest/src/blender/source/blender/blenlib/intern/task.c:418 - 10 0x55fc89111bbf in BLI_task_pool_work_and_wait /home/guest/src/blender/source/blender/blenlib/intern/task.c:899 - 11 0x55fc89158220 in DEG::deg_evaluate_on_refresh(EvaluationContext*, DEG::Depsgraph*, unsigned int) /home/guest/src/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:348 - 12 0x55fc8912fc61 in DEG_evaluate_on_refresh /home/guest/src/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:137 - 13 0x55fc888ba047 in BKE_scene_update_tagged /home/guest/src/blender/source/blender/blenkernel/intern/scene.c:1839 - 14 0x55fc86591dca in wm_event_do_notifiers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:404 - 15 0x55fc8658023f in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:507 - 16 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527 - 17 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) #18 0x55fc86575a99 in _start (/home/guest/src/build_debug/bin/blender+0x2595a99) 0x60c00008b858 is located 24 bytes inside of 128-byte region [0x60c00008b840,0x60c00008b8c0) freed by thread T0 here: - 0 0x7f7525893a10 in free (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1a10) - 1 0x55fc894b75b2 in MEM_lockfree_freeN /home/guest/src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:169 - 2 0x55fc86a2fc14 in pose_grab_with_ik_clear /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:855 - 3 0x55fc86a720b0 in special_aftertrans_update /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:6389 - 4 0x55fc869bdb31 in transformEnd /home/guest/src/blender/source/blender/editors/transform/transform.c:2437 - 5 0x55fc86aa6263 in transform_modal /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:414 - 6 0x55fc865998f2 in wm_handler_operator_call /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1701 - 7 0x55fc8659bc9d in wm_handlers_do_intern /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2119 - 8 0x55fc8659bde3 in wm_handlers_do /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2158 - 9 0x55fc8659d621 in wm_event_do_handlers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2431 - 10 0x55fc86580233 in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:504 - 11 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527 #12 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) previously allocated by thread T0 here: - 0 0x7f7525893ed0 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1ed0) - 1 0x55fc894b7ab8 in MEM_lockfree_callocN /home/guest/src/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:286 - 2 0x55fc884de676 in add_new_constraint_internal /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4606 - 3 0x55fc884de979 in add_new_constraint /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4647 - 4 0x55fc884deb36 in BKE_constraint_add_for_pose /home/guest/src/blender/source/blender/blenkernel/intern/constraint.c:4696 - 5 0x55fc86a303c0 in pose_grab_with_ik_add /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:918 - 6 0x55fc86a30f39 in pose_grab_with_ik /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:1011 - 7 0x55fc86a312ac in createTransPose /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:1062 - 8 0x55fc86a8087e in createTransData /home/guest/src/blender/source/blender/editors/transform/transform_conversions.c:8151 - 9 0x55fc869bc0df in initTransform /home/guest/src/blender/source/blender/editors/transform/transform.c:2131 - 10 0x55fc86aa5f75 in transformops_data /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:367 - 11 0x55fc86aa66b1 in transform_invoke /home/guest/src/blender/source/blender/editors/transform/transform_ops.c:481 - 12 0x55fc86596576 in wm_operator_invoke /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1115 - 13 0x55fc86599d9d in wm_handler_operator_call /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:1767 - 14 0x55fc8659b5e0 in wm_handlers_do_intern /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2047 - 15 0x55fc8659bde3 in wm_handlers_do /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2158 - 16 0x55fc8659db7a in wm_event_do_handlers /home/guest/src/blender/source/blender/windowmanager/intern/wm_event_system.c:2493 - 17 0x55fc86580233 in WM_main /home/guest/src/blender/source/blender/windowmanager/intern/wm.c:504 - 18 0x55fc8657674e in main /home/guest/src/blender/source/creator/creator.c:527 - 19 0x7f751f8cc2b0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202b0) SUMMARY: AddressSanitizer: heap-use-after-free /home/guest/src/blender/source/blender/ikplugin/intern/iksolver_plugin.c:374 in execute_posetree Shadow bytes around the buggy address: 0x0c18800096b0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c18800096c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c18800096d0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c18800096e0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c18800096f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c1880009700: fa fa fa fa fa fa fa fa fd fd fd[fd]fd fd fd fd 0x0c1880009710: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c1880009720: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c1880009730: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c1880009740: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c1880009750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==5733==ABORTING ```

Brendon Murphy commented

2017-07-04 00:45:31 +02:00

Added subscriber: @BrendonMurphy