Crash when instancing a group with an armature (might be only on mesa/intel GPUs ?). #53583

New Issue

Bastien Montagne · 2017-12-18T17:31:05+01:00

Bastien Montagne commented

2017-12-18 17:31:05 +01:00

Open file below, and try to add a new instance of the only group.
blender28_armature_group_instance_crash.blend

For me (using my i7 4700 integrated GPU, Mesa 17.2.5, DRI Intel(R) Haswell Mobile (0x416) ), it crashes immediately, always with following report from ASAN:

=================================================================
==17960==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffe49d884f0 at pc 0x7f1d00dc26c2 bp 0x7ffe49d87d30 sp 0x7ffe49d874e0
READ of size 64 at 0x7ffe49d884f0 thread T0
    - 0 0x7f1d00dc26c1  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1)
    - 1 0x7f1cc25ce4b6  (/usr/lib/x86_64-linux-gnu/dri/i965_dri.so+0x1944b6)
    - 2 0x7f1cc25d0107  (/usr/lib/x86_64-linux-gnu/dri/i965_dri.so+0x196107)
    - 3 0x5631f62362f0 in GPU_shader_uniform_vector /home/i74700deb64/blender/__work__/src/source/blender/gpu/intern/gpu_shader.c:607
    - 4 0x5631f629a3e9 in draw_shgroup /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2001
    - 5 0x5631f629b390 in drw_draw_pass_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2107
    - 6 0x5631f629b53c in DRW_draw_pass /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2132
    - 7 0x5631f62d33d5 in OBJECT_draw_scene /home/i74700deb64/blender/__work__/src/source/blender/draw/modes/object_mode.c:1960
    - 8 0x5631f629ef91 in drw_engines_draw_scene /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2902
    - 9 0x5631f62a1db4 in DRW_draw_render_loop_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3445
    - 10 0x5631f62a15d3 in DRW_draw_view /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3355
    - 11 0x5631f4532735 in view3d_draw_view /home/i74700deb64/blender/__work__/src/source/blender/editors/space_view3d/view3d_draw.c:1878
    - 12 0x5631f4532956 in view3d_main_region_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/space_view3d/view3d_draw.c:1901
    - 13 0x5631f511f800 in ED_region_do_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/screen/area.c:584
    - 14 0x5631f421574b in wm_method_draw_triple /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:573
    - 15 0x5631f4217ca1 in wm_draw_update /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:970
    - 16 0x5631f4206d5e in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:527
    - 17 0x5631f41fc5a9 in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:527
    - 18 0x7f1cf4f41560 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20560)
    - 19 0x5631f41fb869 in _start (/home/i74700deb64/blender/__work__/build_cmake_dbg/bin/blender+0x37a3869)

Address 0x7ffe49d884f0 is located in stack of thread T0 at offset 864 in frame
    #0 0x5631f62a15e6 in DRW_draw_render_loop_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3367

  This frame has 2 object(s):
    [32, 56) 'iter_macro'
    [96, 1760) 'data_' <== Memory access at offset 864 is inside this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) 
Shadow bytes around the buggy address:
  0x1000493a9040: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a9050: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a9060: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a9070: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
=>0x1000493a9090: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8[f8]f8
  0x1000493a90a0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a90b0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a90c0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a90d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
  0x1000493a90e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==17960==ABORTING

Open file below, and try to add a new instance of the only group. [blender28_armature_group_instance_crash.blend](https://archive.blender.org/developer/F1444180/blender28_armature_group_instance_crash.blend) For me (using my i7 4700 integrated GPU, Mesa 17.2.5, DRI Intel(R) Haswell Mobile (0x416) ), it crashes immediately, always with following report from ASAN: ``` ================================================================= ==17960==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7ffe49d884f0 at pc 0x7f1d00dc26c2 bp 0x7ffe49d87d30 sp 0x7ffe49d874e0 READ of size 64 at 0x7ffe49d884f0 thread T0 - 0 0x7f1d00dc26c1 (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) - 1 0x7f1cc25ce4b6 (/usr/lib/x86_64-linux-gnu/dri/i965_dri.so+0x1944b6) - 2 0x7f1cc25d0107 (/usr/lib/x86_64-linux-gnu/dri/i965_dri.so+0x196107) - 3 0x5631f62362f0 in GPU_shader_uniform_vector /home/i74700deb64/blender/__work__/src/source/blender/gpu/intern/gpu_shader.c:607 - 4 0x5631f629a3e9 in draw_shgroup /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2001 - 5 0x5631f629b390 in drw_draw_pass_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2107 - 6 0x5631f629b53c in DRW_draw_pass /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2132 - 7 0x5631f62d33d5 in OBJECT_draw_scene /home/i74700deb64/blender/__work__/src/source/blender/draw/modes/object_mode.c:1960 - 8 0x5631f629ef91 in drw_engines_draw_scene /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:2902 - 9 0x5631f62a1db4 in DRW_draw_render_loop_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3445 - 10 0x5631f62a15d3 in DRW_draw_view /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3355 - 11 0x5631f4532735 in view3d_draw_view /home/i74700deb64/blender/__work__/src/source/blender/editors/space_view3d/view3d_draw.c:1878 - 12 0x5631f4532956 in view3d_main_region_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/space_view3d/view3d_draw.c:1901 - 13 0x5631f511f800 in ED_region_do_draw /home/i74700deb64/blender/__work__/src/source/blender/editors/screen/area.c:584 - 14 0x5631f421574b in wm_method_draw_triple /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:573 - 15 0x5631f4217ca1 in wm_draw_update /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm_draw.c:970 - 16 0x5631f4206d5e in WM_main /home/i74700deb64/blender/__work__/src/source/blender/windowmanager/intern/wm.c:527 - 17 0x5631f41fc5a9 in main /home/i74700deb64/blender/__work__/src/source/creator/creator.c:527 - 18 0x7f1cf4f41560 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x20560) - 19 0x5631f41fb869 in _start (/home/i74700deb64/blender/__work__/build_cmake_dbg/bin/blender+0x37a3869) Address 0x7ffe49d884f0 is located in stack of thread T0 at offset 864 in frame #0 0x5631f62a15e6 in DRW_draw_render_loop_ex /home/i74700deb64/blender/__work__/src/source/blender/draw/intern/draw_manager.c:3367 This frame has 2 object(s): [32, 56) 'iter_macro' [96, 1760) 'data_' <== Memory access at offset 864 is inside this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-use-after-scope (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x766c1) Shadow bytes around the buggy address: 0x1000493a9040: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a9050: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a9060: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a9070: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a9080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 =>0x1000493a9090: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8[f8]f8 0x1000493a90a0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a90b0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a90c0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a90d0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 0x1000493a90e0: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==17960==ABORTING ```

Bastien Montagne commented

2017-12-18 17:31:05 +01:00

Added subscriber: @mont29

Dalai Felinto commented

2017-12-19 13:03:19 +01:00

Added subscriber: @dfelinto

Dalai Felinto self-assigned this 2017-12-19 13:03:19 +01:00

Dalai Felinto commented

2017-12-19 13:03:19 +01:00

The problem is the following assert:

BLI_assert failed: /home/dfelinto/src/blender/blender/source/blender/blenkernel/intern/object_dupli.c:324, make_duplis_group(), at 'base->collection_properties != ((void *)0)'

Let me investigate it.

The problem is the following assert: ``` BLI_assert failed: /home/dfelinto/src/blender/blender/source/blender/blenkernel/intern/object_dupli.c:324, make_duplis_group(), at 'base->collection_properties != ((void *)0)' ``` Let me investigate it.

blender-admin commented

2017-12-19 13:36:14 +01:00

This issue was referenced by 672c9a9a6d

This issue was referenced by 672c9a9a6d6a06a24bda3ef31b5713c51f05e033

Dalai Felinto commented

2017-12-19 13:46:49 +01:00

Changed status from 'Open' to: 'Resolved'

Dalai Felinto closed this issue

2017-12-19 13:46:49 +01:00

Bastien Montagne commented

2017-12-19 14:30:06 +01:00

Changed status from 'Resolved' to: 'Open'

Bastien Montagne reopened this issue

2017-12-19 14:30:06 +01:00

Bastien Montagne commented

2017-12-19 14:30:06 +01:00

672c9a9a6d does fix the assert that was detected alongside the bug reported here, however those asserts were not the issue here, as show by the backtrace, crash happens due to some illegal memory access deep down the drawing code of armature when part of a group instance.

Don’t know whether bug is in Blender code or MESA driver, tbh…

672c9a9a6d does fix the assert that was detected alongside the bug reported here, however those asserts were not the issue here, as show by the backtrace, crash happens due to some illegal memory access deep down the drawing code of armature when part of a group instance. Don’t know whether bug is in Blender code or MESA driver, tbh…

Dalai Felinto removed their assignment 2017-12-19 14:34:50 +01:00

Clément Foucault was assigned by Dalai Felinto

2017-12-19 14:34:50 +01:00

Dalai Felinto commented

2017-12-19 14:34:50 +01:00

Although I can't reproduce this, I think this is due to the known limitation of draw manager and duplis. I couldn't find an open bug report for that, so let's make this one the official one, and assigning it to Clément meanwhile.

Dalai Felinto commented

2017-12-19 15:05:18 +01:00

This is a quicker way to reproduce according to Bastien, just open this file blender28_armature_group_instance_crash_saved.blend
This is the same file originally reported, with the group instanced.

This is a quicker way to reproduce according to Bastien, just open this file [blender28_armature_group_instance_crash_saved.blend](https://archive.blender.org/developer/F1455916/blender28_armature_group_instance_crash_saved.blend) This is the same file originally reported, with the group instanced.

Bastien Montagne commented

2017-12-19 15:20:50 +01:00

Worth noting that with a release build, I get no crash at all, and the armature in the instantiated group does draw for me…

blender-admin commented

2018-01-11 19:35:56 +01:00

This issue was referenced by da97b6930b

This issue was referenced by da97b6930b47555fbc526b7165d5b73abe06252d

Clément Foucault commented

2018-01-11 19:36:13 +01:00

Changed status from 'Open' to: 'Resolved'

Clément Foucault closed this issue

2018-01-11 19:36:13 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when instancing a group with an armature (might be only on mesa/intel GPUs ?). #53583