Crash due to zero uniform buffer binding for sssProfile #55475

New Issue

Ghost · 2018-06-13T23:11:43+02:00

Ghost commented

2018-06-13 23:11:43 +02:00

System Information
macOS 10.12.6
Intel Iris Graphics 6100 1536 MB

Blender Version
Broken: 2f3e890b94 blender2.8 (modified) (built from head of blender2.8 branch)

Short description of error
Blender crashes in macOS Intel OpenGL driver when rendering materials due to 0 being bound to the 'sssProfile' uniform block.

Exact steps for others to reproduce the error

Open Blender.
In the Properties Editor, select the Material tab.
Use the dropdown near the top left of the window to switch the main area to the Shader Editor.
In the Properties Editor, enable and disable 'Use Nodes' several times.
Blender will crash with the following backtrace:

* thread #18, stop reason = EXC_BAD_ACCESS (code=1, address=0x100)
  * frame #0: 0x00007fff84799178 IOAccelerator`IOAccelContextAddResource + 8
    frame #1: 0x0000000117dcffa0 AppleIntelBDWGraphicsGLDriver`void updateBindingTable<SGfx3dStateBindingTablePointers>(GenContext*, unsigned int, SGfx3dStateBindingTablePointers&) + 2887
    frame #2: 0x0000000117dcc9f3 AppleIntelBDWGraphicsGLDriver`GenContext::ProgramPipeline() + 15463
    frame #3: 0x0000000117deabdd AppleIntelBDWGraphicsGLDriver`glrIntelRenderVertexArray + 391
    frame #4: 0x000000011780bbc5 GLEngine`glDrawRangeElements_GL3Exec + 315
    frame #5: 0x00007fff79ea1980 libGL.dylib`glDrawRangeElements + 45
    frame #6: 0x0000000105ae43c4 blender`GWN_batch_draw_range_ex(batch=0x000060d00034d860, v_first=0, v_count=23040, force_instance=false) at gwn_batch.c:710
    frame #7: 0x0000000100eb1b2e blender`draw_geometry_execute_ex(shgroup=0x0000631000461c40, geom=0x000060d00034d860, start=0, count=0, draw_instance=false) at draw_manager_exec.c:847
    frame #8: 0x0000000100eb1f06 blender`draw_geometry_execute(shgroup=0x0000631000461c40, geom=0x000060d00034d860) at draw_manager_exec.c:854
    frame #9: 0x0000000100eb0fb6 blender`draw_shgroup(shgroup=0x0000631000461c40, pass_state=525346) at draw_manager_exec.c:1159
    frame #10: 0x0000000100eafa44 blender`drw_draw_pass_ex(pass=0x0000621000d00040, start_group=0x0000631000461ba0, end_group=0x0000631000461c40) at draw_manager_exec.c:1232
    frame #11: 0x0000000100eaf954 blender`DRW_draw_pass(pass=0x0000621000d00040) at draw_manager_exec.c:1265
    frame #12: 0x0000000100ee6b8c blender`EEVEE_draw_default_passes(psl=0x00006210002abd38) at eevee_materials.c:1753
    frame #13: 0x0000000100ee9b06 blender`EEVEE_render_draw(vedata=0x000061700051bbb8, engine=0x00006180001728b8, rl=0x0000611000619bf8, rect=0x0000700007b66b88) at eevee_render.c:510
    frame #14: 0x0000000100ed4dad blender`eevee_render_to_image(vedata=0x000061700051bbb8, engine=0x00006180001728b8, render_layer=0x0000611000619bf8, rect=0x0000700007b66b88) at eevee_engine.c:414
    frame #15: 0x0000000100ea7455 blender`DRW_render_to_image(engine=0x00006180001728b8, depsgraph=0x0000611000379a38) at draw_manager.c:1548
    frame #16: 0x0000000100868a74 blender`RE_engine_render(re=0x000062200012d938, do_all=0) at external_engine.c:740
    frame #17: 0x000000010087aff5 blender`do_render_3d(re=0x000062200012d938) at pipeline.c:1082
    frame #18: 0x000000010087d357 blender`RE_PreviewRender(re=0x000062200012d938, bmain=0x000061c00025d0b8, sce=0x000062200021c138) at pipeline.c:2624
    frame #19: 0x00000001007751a7 blender`shader_preview_render(sp=0x0000611000373778, id=0x0000614000021078, split=0, first=0) at render_preview.c:750
    frame #20: 0x0000000100774b81 blender`shader_preview_startjob(customdata=0x0000611000373778, stop=0x000061300037246c, do_update=0x000061300037246a) at render_preview.c:787
    frame #21: 0x0000000100774469 blender`common_preview_startjob(customdata=0x0000611000373778, stop=0x000061300037246c, do_update=0x000061300037246a, UNUSED_progress=0x0000613000372470) at render_preview.c:1026
    frame #22: 0x0000000100160f67 blender`do_job_thread(job_v=0x00006130003723f8) at wm_jobs.c:337
    frame #23: 0x0000000101628cc1 blender`tslot_thread_start(tslot_p=0x000060b0003fdd38) at threads.c:253
    frame #24: 0x00007fff8b3f093b libsystem_pthread.dylib`_pthread_body + 180
    frame #25: 0x00007fff8b3f0887 libsystem_pthread.dylib`_pthread_start + 286
    frame #26: 0x00007fff8b3f008d libsystem_pthread.dylib`thread_start + 13

Investigation

I have debugged and managed to track the crash down to a missing uniform buffer. When the crash occurs, the active shader program has an active uniform block 'sssProfile'.

For the 'sssProfile' uniform block, GL_UNIFORM_BLOCK_BINDING is 0.

For uniform binding 0, GL_UNIFORM_BUFFER_BINDING is 0.

Therefore, there is no uniform buffer bound to the 'sssProfile' uniform block. I suspect there is also no texture bound to the 'sssTexProfile' sampler either. I am assuming for this shader this uniform block is coming from lamps_lib.glsl, although an identical uniform block is also present in effect_subsurface_frag.glsl.

I can prevent the crash by binding a dummy uniform buffer of the correct size to 'sssProfile'. In this case the rendering of the material in the preview appears corrupt.

I tried adding an #if !defined(USE_TRANSLUCENCY) || defined(VOLUMETRICS) around the uniform block and corresponding sss_profile function in the glsl file, but the problem persists. I suspect that there is a case where this uniform block is actually being accessed without the uniform buffer being bound.

My check for missing uniform buffers also fires on 'clip_block' in other shaders.

**System Information** macOS 10.12.6 Intel Iris Graphics 6100 1536 MB **Blender Version** Broken: 2f3e890b94e blender2.8 (modified) (built from head of blender2.8 branch) **Short description of error** Blender crashes in macOS Intel OpenGL driver when rendering materials due to 0 being bound to the 'sssProfile' uniform block. **Exact steps for others to reproduce the error** - Open Blender. - In the Properties Editor, select the Material tab. - Use the dropdown near the top left of the window to switch the main area to the Shader Editor. - In the Properties Editor, enable and disable 'Use Nodes' several times. - Blender will crash with the following backtrace: ``` * thread #18, stop reason = EXC_BAD_ACCESS (code=1, address=0x100) * frame #0: 0x00007fff84799178 IOAccelerator`IOAccelContextAddResource + 8 frame #1: 0x0000000117dcffa0 AppleIntelBDWGraphicsGLDriver`void updateBindingTable<SGfx3dStateBindingTablePointers>(GenContext*, unsigned int, SGfx3dStateBindingTablePointers&) + 2887 frame #2: 0x0000000117dcc9f3 AppleIntelBDWGraphicsGLDriver`GenContext::ProgramPipeline() + 15463 frame #3: 0x0000000117deabdd AppleIntelBDWGraphicsGLDriver`glrIntelRenderVertexArray + 391 frame #4: 0x000000011780bbc5 GLEngine`glDrawRangeElements_GL3Exec + 315 frame #5: 0x00007fff79ea1980 libGL.dylib`glDrawRangeElements + 45 frame #6: 0x0000000105ae43c4 blender`GWN_batch_draw_range_ex(batch=0x000060d00034d860, v_first=0, v_count=23040, force_instance=false) at gwn_batch.c:710 frame #7: 0x0000000100eb1b2e blender`draw_geometry_execute_ex(shgroup=0x0000631000461c40, geom=0x000060d00034d860, start=0, count=0, draw_instance=false) at draw_manager_exec.c:847 frame #8: 0x0000000100eb1f06 blender`draw_geometry_execute(shgroup=0x0000631000461c40, geom=0x000060d00034d860) at draw_manager_exec.c:854 frame #9: 0x0000000100eb0fb6 blender`draw_shgroup(shgroup=0x0000631000461c40, pass_state=525346) at draw_manager_exec.c:1159 frame #10: 0x0000000100eafa44 blender`drw_draw_pass_ex(pass=0x0000621000d00040, start_group=0x0000631000461ba0, end_group=0x0000631000461c40) at draw_manager_exec.c:1232 frame #11: 0x0000000100eaf954 blender`DRW_draw_pass(pass=0x0000621000d00040) at draw_manager_exec.c:1265 frame #12: 0x0000000100ee6b8c blender`EEVEE_draw_default_passes(psl=0x00006210002abd38) at eevee_materials.c:1753 frame #13: 0x0000000100ee9b06 blender`EEVEE_render_draw(vedata=0x000061700051bbb8, engine=0x00006180001728b8, rl=0x0000611000619bf8, rect=0x0000700007b66b88) at eevee_render.c:510 frame #14: 0x0000000100ed4dad blender`eevee_render_to_image(vedata=0x000061700051bbb8, engine=0x00006180001728b8, render_layer=0x0000611000619bf8, rect=0x0000700007b66b88) at eevee_engine.c:414 frame #15: 0x0000000100ea7455 blender`DRW_render_to_image(engine=0x00006180001728b8, depsgraph=0x0000611000379a38) at draw_manager.c:1548 frame #16: 0x0000000100868a74 blender`RE_engine_render(re=0x000062200012d938, do_all=0) at external_engine.c:740 frame #17: 0x000000010087aff5 blender`do_render_3d(re=0x000062200012d938) at pipeline.c:1082 frame #18: 0x000000010087d357 blender`RE_PreviewRender(re=0x000062200012d938, bmain=0x000061c00025d0b8, sce=0x000062200021c138) at pipeline.c:2624 frame #19: 0x00000001007751a7 blender`shader_preview_render(sp=0x0000611000373778, id=0x0000614000021078, split=0, first=0) at render_preview.c:750 frame #20: 0x0000000100774b81 blender`shader_preview_startjob(customdata=0x0000611000373778, stop=0x000061300037246c, do_update=0x000061300037246a) at render_preview.c:787 frame #21: 0x0000000100774469 blender`common_preview_startjob(customdata=0x0000611000373778, stop=0x000061300037246c, do_update=0x000061300037246a, UNUSED_progress=0x0000613000372470) at render_preview.c:1026 frame #22: 0x0000000100160f67 blender`do_job_thread(job_v=0x00006130003723f8) at wm_jobs.c:337 frame #23: 0x0000000101628cc1 blender`tslot_thread_start(tslot_p=0x000060b0003fdd38) at threads.c:253 frame #24: 0x00007fff8b3f093b libsystem_pthread.dylib`_pthread_body + 180 frame #25: 0x00007fff8b3f0887 libsystem_pthread.dylib`_pthread_start + 286 frame #26: 0x00007fff8b3f008d libsystem_pthread.dylib`thread_start + 13 ``` **Investigation** I have debugged and managed to track the crash down to a missing uniform buffer. When the crash occurs, the active shader program has an active uniform block 'sssProfile'. For the 'sssProfile' uniform block, GL_UNIFORM_BLOCK_BINDING is 0. For uniform binding 0, GL_UNIFORM_BUFFER_BINDING is 0. Therefore, there is no uniform buffer bound to the 'sssProfile' uniform block. I suspect there is also no texture bound to the 'sssTexProfile' sampler either. I am assuming for this shader this uniform block is coming from lamps_lib.glsl, although an identical uniform block is also present in effect_subsurface_frag.glsl. I can prevent the crash by binding a dummy uniform buffer of the correct size to 'sssProfile'. In this case the rendering of the material in the preview appears corrupt. I tried adding an `#if !defined(USE_TRANSLUCENCY) || defined(VOLUMETRICS)` around the uniform block and corresponding sss_profile function in the glsl file, but the problem persists. I suspect that there is a case where this uniform block is actually being accessed without the uniform buffer being bound. My check for missing uniform buffers also fires on 'clip_block' in other shaders.

Ghost commented

2018-06-13 23:11:43 +02:00

Added subscriber: @EdmundKapusniak

blender-admin commented

2018-06-13 23:11:43 +02:00

#56132 was marked as duplicate of this issue

Brecht Van Lommel commented

2018-06-14 18:33:45 +02:00

Added subscribers: @fclem, @brecht

Clément Foucault was assigned by Brecht Van Lommel

2018-06-14 18:33:45 +02:00

Brecht Van Lommel commented

2018-06-14 18:33:45 +02:00

Assigning to @fclem for advice.

Clément Foucault commented

2018-07-23 20:50:45 +02:00

There was a bad free of Uniform buffer as well as framebuffers that happened when using the shader preview. This was fixed.

@EdmundKapusniak can you still reproduce with latest build?

There was a bad free of Uniform buffer as well as framebuffers that happened when using the shader preview. This was fixed. @EdmundKapusniak can you still reproduce with latest build?

Ghost commented

2018-07-29 12:55:05 +02:00

Unfortunately yes, the crash is intermittent but still happens in build dated 2018-07-28, hash f50fa4c5d6.

Same repro steps:

Open Blender.
Switch to Materials tab of the Properties Editor.
Open the Preview of the material.
Switch to Shader Editor in main area.
Enable Use Nodes.
Blender will sometimes crash.
If it doesn't crash, the material preview will display with artefacts.

Here is the backtrace from the Apple crash report dialog, very similar to the backtrace above:

Thread 16:
0   com.apple.IOAccelerator       	0x00007fff95875178 IOAccelContextAddResource + 8
1   com.apple.driver.AppleIntelBDWGraphicsGLDriver	0x000000011339cfa0 void updateBindingTable<SGfx3dStateBindingTablePointers>(GenContext*, unsigned int, SGfx3dStateBindingTablePointers&) + 2887
2   com.apple.driver.AppleIntelBDWGraphicsGLDriver	0x00000001133999f3 GenContext::ProgramPipeline() + 15463
3   com.apple.driver.AppleIntelBDWGraphicsGLDriver	0x00000001133b7bdd glrIntelRenderVertexArray + 391
4   GLEngine                      	0x0000000112dd8bc5 glDrawRangeElements_GL3Exec + 315
5   libGL.dylib                   	0x00007fff8af7d980 glDrawRangeElements + 45
6   org.blenderfoundation.blender 	0x000000010679a6ee GPU_batch_draw_range_ex + 494
7   org.blenderfoundation.blender 	0x00000001067e2f5a drw_draw_pass_ex + 1738
8   org.blenderfoundation.blender 	0x0000000106805026 EEVEE_render_draw + 1510
9   org.blenderfoundation.blender 	0x00000001067dc277 DRW_render_to_image + 695
10  org.blenderfoundation.blender 	0x000000010654dd6d RE_engine_render + 973
11  org.blenderfoundation.blender 	0x00000001064b41c2 shader_preview_render + 530
12  org.blenderfoundation.blender 	0x00000001064b3bf2 common_preview_startjob + 370
13  org.blenderfoundation.blender 	0x00000001061ce2ff do_job_thread + 31
14  libsystem_pthread.dylib       	0x00007fff9c4d093b _pthread_body + 180
15  libsystem_pthread.dylib       	0x00007fff9c4d0887 _pthread_start + 286
16  libsystem_pthread.dylib       	0x00007fff9c4d008d thread_start + 13

The crash appears to be somehow timing dependent - performing the repro steps quickly will result in a greater chance of it crashing. I have attached a screenshot of the artefacts on the material.

Unfortunately yes, the crash is intermittent but still happens in build dated 2018-07-28, hash f50fa4c5d69. Same repro steps: - Open Blender. - Switch to Materials tab of the Properties Editor. - Open the Preview of the material. - Switch to Shader Editor in main area. - Enable Use Nodes. - Blender will sometimes crash. - If it doesn't crash, the material preview will display with artefacts. Here is the backtrace from the Apple crash report dialog, very similar to the backtrace above: ``` Thread 16: 0 com.apple.IOAccelerator 0x00007fff95875178 IOAccelContextAddResource + 8 1 com.apple.driver.AppleIntelBDWGraphicsGLDriver 0x000000011339cfa0 void updateBindingTable<SGfx3dStateBindingTablePointers>(GenContext*, unsigned int, SGfx3dStateBindingTablePointers&) + 2887 2 com.apple.driver.AppleIntelBDWGraphicsGLDriver 0x00000001133999f3 GenContext::ProgramPipeline() + 15463 3 com.apple.driver.AppleIntelBDWGraphicsGLDriver 0x00000001133b7bdd glrIntelRenderVertexArray + 391 4 GLEngine 0x0000000112dd8bc5 glDrawRangeElements_GL3Exec + 315 5 libGL.dylib 0x00007fff8af7d980 glDrawRangeElements + 45 6 org.blenderfoundation.blender 0x000000010679a6ee GPU_batch_draw_range_ex + 494 7 org.blenderfoundation.blender 0x00000001067e2f5a drw_draw_pass_ex + 1738 8 org.blenderfoundation.blender 0x0000000106805026 EEVEE_render_draw + 1510 9 org.blenderfoundation.blender 0x00000001067dc277 DRW_render_to_image + 695 10 org.blenderfoundation.blender 0x000000010654dd6d RE_engine_render + 973 11 org.blenderfoundation.blender 0x00000001064b41c2 shader_preview_render + 530 12 org.blenderfoundation.blender 0x00000001064b3bf2 common_preview_startjob + 370 13 org.blenderfoundation.blender 0x00000001061ce2ff do_job_thread + 31 14 libsystem_pthread.dylib 0x00007fff9c4d093b _pthread_body + 180 15 libsystem_pthread.dylib 0x00007fff9c4d0887 _pthread_start + 286 16 libsystem_pthread.dylib 0x00007fff9c4d008d thread_start + 13 ``` The crash appears to be somehow timing dependent - performing the repro steps quickly will result in a greater chance of it crashing. I have attached a screenshot of the artefacts on the material. ![Screen Shot 2018-07-29 at 11.51.13.png](https://archive.blender.org/developer/F4076183/Screen_Shot_2018-07-29_at_11.51.13.png)

Ghost commented

2018-07-29 13:45:08 +02:00

Here is a patch for gpu_batch.c that detects when there are missing uniform buffers.

With PREVENT_CRASH defined, a dummy uniform buffer is created and bound to the missing active uniform blocks. In this case, the materials still render with artefacts, but I have not been able to reproduce the crash.

Example output while rendering material previews with this patch applied:

ZERO BUFFER: common_block -> 0 -> 0 [464]
ZERO BUFFER: common_block -> 0 -> 0 [464]
ZERO BUFFER: clip_block -> 0 -> 0 [16]
ZERO BUFFER: sssProfile -> 0 -> 0 [1072]
ZERO BUFFER: sssProfile -> 0 -> 0 [1072]
ZERO BUFFER: sssProfile -> 0 -> 0 [1072]
ZERO BUFFER: common_block -> 0 -> 0 [464]
ZERO BUFFER: sssProfile -> 0 -> 0 [1072]

#55475-debug.diff

Here is a patch for gpu_batch.c that detects when there are missing uniform buffers. With `PREVENT_CRASH` defined, a dummy uniform buffer is created and bound to the missing active uniform blocks. In this case, the materials still render with artefacts, but I have not been able to reproduce the crash. Example output while rendering material previews with this patch applied: ``` ZERO BUFFER: common_block -> 0 -> 0 [464] ZERO BUFFER: common_block -> 0 -> 0 [464] ZERO BUFFER: clip_block -> 0 -> 0 [16] ZERO BUFFER: sssProfile -> 0 -> 0 [1072] ZERO BUFFER: sssProfile -> 0 -> 0 [1072] ZERO BUFFER: sssProfile -> 0 -> 0 [1072] ZERO BUFFER: common_block -> 0 -> 0 [464] ZERO BUFFER: sssProfile -> 0 -> 0 [1072] ``` [#55475-debug.diff](https://archive.blender.org/developer/F4076530/T55475-debug.diff)

Arto Kitula commented

2018-07-29 20:30:04 +02:00

Added subscribers: @kostex, @ArtoKitula, @brita

Arto Kitula commented

2018-07-29 21:05:19 +02:00

This is indeed Intel-only thing. I can crash blender on GPU_batch_draw_range_ex when enabling only Intel GPU on my MacBookPro.

Clément Foucault commented

2018-08-02 21:15:47 +02:00

Should be fixed by 3578212e46

@EdmundKapusniak Thanks for the patch it was very helpful. I integrated it to the debug build.

@ArtoKitula Can you try again with the latest build?

Should be fixed by 3578212e46 @EdmundKapusniak Thanks for the patch it was very helpful. I integrated it to the debug build. @ArtoKitula Can you try again with the latest build?

Roel Koster commented

2018-08-02 22:17:18 +02:00

I've built blender 2a8413a0dd
So far I can say it's a stable build regarding this issue!
Cool!

I've built blender 2a8413a0ddd So far I can say it's a stable build regarding this issue! Cool!

Arto Kitula commented

2018-08-04 14:01:59 +02:00

Changed status from 'Open' to: 'Resolved'

Arto Kitula closed this issue

2018-08-04 14:01:59 +02:00

Arto Kitula commented

2018-08-04 14:01:59 +02:00

@fclem tested, works. marking as resolved.

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash due to zero uniform buffer binding for sssProfile #55475