[2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes #78392

New Issue

Jawad Alshakhs · 2020-06-28T20:56:28+02:00

Jawad Alshakhs commented

2020-06-28 20:56:28 +02:00

System Information
Operating system: Windows-10-10.0.18362-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 442.19

Blender Version
Broken: version: 2.90.0 Alpha, branch: master, commit date: 2020-06-27 21:56, hash: 59d2dd2237
Broken: version: 2.83.1, branch: master, commit date: 2020-06-25 09:47, hash: 8289fc688b
Worked: 2.82 (sub 7), branch: master, commit date: 2020-02-12 16:20, hash: 77d23b0bd7

Short description of error
Crashes when undo/ redo enters and exits different modes; tested with object and edit mode on default startup file and consistently crashes.

Exact steps for others to reproduce the error

select default cube and press (tab) several times to cycle modes from object to edit mode (3-4 times or more)
undo shortcut (ctrl z) several times (3-4 times or more causes crash)
redo shortcut (ctrl shift z) crashes blender (always crashes on the 3rd or 4th redo on my system)

Based on the default 2.83.1 and 2.9 startup files; tested on 2.82 with 256 undo/ redo steps without any crashes.

**System Information** Operating system: Windows-10-10.0.18362-SP0 64 Bits Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 442.19 **Blender Version** Broken: version: 2.90.0 Alpha, branch: master, commit date: 2020-06-27 21:56, hash: `59d2dd2237` Broken: version: 2.83.1, branch: master, commit date: 2020-06-25 09:47, hash: `8289fc688b` Worked: 2.82 (sub 7), branch: master, commit date: 2020-02-12 16:20, hash: `77d23b0bd7` **Short description of error** Crashes when undo/ redo enters and exits different modes; tested with object and edit mode on default startup file and consistently crashes. **Exact steps for others to reproduce the error** - select default cube and press (tab) several times to cycle modes from object to edit mode (3-4 times or more) - undo shortcut (ctrl z) several times (3-4 times or more causes crash) - redo shortcut (ctrl shift z) crashes blender (always crashes on the 3rd or 4th redo on my system) Based on the default 2.83.1 and 2.9 startup files; tested on 2.82 with 256 undo/ redo steps without any crashes.

Jawad Alshakhs commented

2020-06-28 20:56:28 +02:00

Added subscriber: @jshakhs

blender-admin commented

2020-06-28 20:56:28 +02:00

#80377 was marked as duplicate of this issue

blender-admin commented

2020-06-28 20:56:28 +02:00

#79049 was marked as duplicate of this issue

Vincent Blankfield commented

2020-06-29 23:17:13 +02:00

Added subscriber: @VincentBlankfield

Vincent Blankfield commented

2020-06-29 23:17:14 +02:00

Reproduced. Crashes on redo. No crash with Preferences > Experimental > Undo Legacy.

Stack trace:

>	ui_but_value_get(but=0x000001b9137e2e48) Line 2378

 	ui_but_is_pushed_ex(but=0x000001b9137e2e48, value=0x00000063c4bfea70) Line 2002
 	[Inline Frame] ui_but_update_select_flag() Line 2086
 	ui_but_update_ex(but=0x000001b9137e2e48, validate) Line 3506
 	[Inline Frame] ui_but_update() Line 3676
 	[Inline Frame] ui_but_update_and_icon_set() Line 4631
 	uiDefIconBut(block, type, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5019
 	uiDefIconButBit(block=0x000001b9137b3a38, type, bit, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5057
 	uiTemplateEditModeSelection(layout=0x000001b913436f68, C) Line 162
 	uiTemplateHeader3D_mode(layout=0x000001b913436f68, C=0x000001b904858c18) Line 238
 	RNA_function_call(C, reports, ptr, func, parms=0x00000063c4bfef88) Line 7494
 	pyrna_func_call(self, args, kw=0x0000000000000000) Line 6328
 	[External Code]	
 	bpy_class_call(C=0x000001b904858c18, ptr=0x00000063c4bff950, func=0x00007ff6ceeff300, parms=0x00000063c4bff968) Line 8513
 	header_draw(C=0x000001b904858c18, hdr=0x00000063c4bff9f0) Line 707
 	ED_region_header_layout(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2872
 	ED_region_header(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2935
 	ED_region_do_draw(C=0x000001b904858c18, region=0x000001b9074367f8) Line 543
 	wm_draw_window_offscreen(C=0x000001b904858c18, win=0x000001b906eaa2b8, stereo) Line 713
 	wm_draw_window(C=0x000001b904858c18, win=0x000001b906eaa2b8) Line 841
 	wm_draw_update(C=0x000001b904858c18) Line 1042
 	WM_main(C=0x000001b904858c18) Line 482
 	main(argc=1, UNUSED_argv_c=0x0000000000000000) Line 534
 	[External Code]

This:

diff --git a/source/blender/editors/space_view3d/view3d_header.c b/source/blender/editors/space_view3d/view3d_header.c
index f2e42cd1725..3668c3060a2 100644
--- a/source/blender/editors/space_view3d/view3d_header.c
+++ b/source/blender/editors/space_view3d/view3d_header.c
@@ -136,11 +136,34 @@ void uiTemplateEditModeSelection(uiLayout *layout, struct bContext *C)

   UI_block_func_handle_set(block, do_view3d_header_buttons, NULL);

+  ********************************************//
+  printf("Entered uiTemplateEditModeSelection in %s\n", CTX_data_mode_string(C));
+  ********************************************//
+
   if (obedit && (obedit->type == OB_MESH)) {
     BMEditMesh *em = BKE_editmesh_from_object(obedit);
     uiLayout *row;
     uiBut *but;

+    ********************************************//
+    if (BKE_editmesh_from_object(CTX_data_edit_object(C)) == NULL) {
+      printf("Context says we're in %s\n", CTX_data_mode_string(C));
+      printf("But there's no edit object editmesh\n");
+      printf("em=%x, &em-selectmode=%x\n", em, &em->selectmode);
+      printf("If we continue execution, we will crash in ui_but_value_get() Line 2378\n");
+      printf("Because it will try to access (short *)but->poin\n");
+      printf("which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode\n");
+      printf("and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL\n");
+      printf("So I'm going to return now.\n");
+      printf("Notice how the viewport mode button is now broken.\n");
+      printf("Also all further redos will fail here.\n");
+      printf("An attempt to switch the mode (using tab or the button) may crash or recover\n");
+      printf("from this broken state.\n");
+      return;
+    }
+    ********************************************//
+
     row = uiLayoutRow(layout, true);
     block = uiLayoutGetBlock(row);
     but = uiDefIconButBitS(

will give following output (just hitting Ctrl+Shift+Z after tabbing a bunch of times, and undoing it all):

Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in mesh_edit
Context says we're in mesh_edit
But there's no edit object editmesh
em=0, &em-selectmode=68
If we continue execution, we will crash in ui_but_value_get() Line 2378
Because it will try to access (short *)but->poin
which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode
and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL
So I'm going to return now.
Notice how the viewport mode button is now broken.
Also all further redos will fail here.
An attempt to switch the mode (using tab or the button) may crash or recover
from this broken state.

So in the last "bad" redo the context got messed up, indicating that we're in edit mode, when we should've been and indeed are in object mode (notice the switches edit-object-edit-edit).

Reproduced. Crashes on redo. No crash with `Preferences > Experimental > Undo Legacy`. Stack trace: ``` > ui_but_value_get(but=0x000001b9137e2e48) Line 2378 ui_but_is_pushed_ex(but=0x000001b9137e2e48, value=0x00000063c4bfea70) Line 2002 [Inline Frame] ui_but_update_select_flag() Line 2086 ui_but_update_ex(but=0x000001b9137e2e48, validate) Line 3506 [Inline Frame] ui_but_update() Line 3676 [Inline Frame] ui_but_update_and_icon_set() Line 4631 uiDefIconBut(block, type, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5019 uiDefIconButBit(block=0x000001b9137b3a38, type, bit, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5057 uiTemplateEditModeSelection(layout=0x000001b913436f68, C) Line 162 uiTemplateHeader3D_mode(layout=0x000001b913436f68, C=0x000001b904858c18) Line 238 RNA_function_call(C, reports, ptr, func, parms=0x00000063c4bfef88) Line 7494 pyrna_func_call(self, args, kw=0x0000000000000000) Line 6328 [External Code] bpy_class_call(C=0x000001b904858c18, ptr=0x00000063c4bff950, func=0x00007ff6ceeff300, parms=0x00000063c4bff968) Line 8513 header_draw(C=0x000001b904858c18, hdr=0x00000063c4bff9f0) Line 707 ED_region_header_layout(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2872 ED_region_header(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2935 ED_region_do_draw(C=0x000001b904858c18, region=0x000001b9074367f8) Line 543 wm_draw_window_offscreen(C=0x000001b904858c18, win=0x000001b906eaa2b8, stereo) Line 713 wm_draw_window(C=0x000001b904858c18, win=0x000001b906eaa2b8) Line 841 wm_draw_update(C=0x000001b904858c18) Line 1042 WM_main(C=0x000001b904858c18) Line 482 main(argc=1, UNUSED_argv_c=0x0000000000000000) Line 534 [External Code] ``` This: ``` diff --git a/source/blender/editors/space_view3d/view3d_header.c b/source/blender/editors/space_view3d/view3d_header.c index f2e42cd1725..3668c3060a2 100644 --- a/source/blender/editors/space_view3d/view3d_header.c +++ b/source/blender/editors/space_view3d/view3d_header.c @@ -136,11 +136,34 @@ void uiTemplateEditModeSelection(uiLayout *layout, struct bContext *C) UI_block_func_handle_set(block, do_view3d_header_buttons, NULL); + ********************************************// + printf("Entered uiTemplateEditModeSelection in %s\n", CTX_data_mode_string(C)); + ********************************************// + if (obedit && (obedit->type == OB_MESH)) { BMEditMesh *em = BKE_editmesh_from_object(obedit); uiLayout *row; uiBut *but; + ********************************************// + if (BKE_editmesh_from_object(CTX_data_edit_object(C)) == NULL) { + printf("Context says we're in %s\n", CTX_data_mode_string(C)); + printf("But there's no edit object editmesh\n"); + printf("em=%x, &em-selectmode=%x\n", em, &em->selectmode); + printf("If we continue execution, we will crash in ui_but_value_get() Line 2378\n"); + printf("Because it will try to access (short *)but->poin\n"); + printf("which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode\n"); + printf("and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL\n"); + printf("So I'm going to return now.\n"); + printf("Notice how the viewport mode button is now broken.\n"); + printf("Also all further redos will fail here.\n"); + printf("An attempt to switch the mode (using tab or the button) may crash or recover\n"); + printf("from this broken state.\n"); + return; + } + ********************************************// + row = uiLayoutRow(layout, true); block = uiLayoutGetBlock(row); but = uiDefIconButBitS( ``` will give following output (just hitting `Ctrl+Shift+Z` after tabbing a bunch of times, and undoing it all): ``` Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in mesh_edit Context says we're in mesh_edit But there's no edit object editmesh em=0, &em-selectmode=68 If we continue execution, we will crash in ui_but_value_get() Line 2378 Because it will try to access (short *)but->poin which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL So I'm going to return now. Notice how the viewport mode button is now broken. Also all further redos will fail here. An attempt to switch the mode (using tab or the button) may crash or recover from this broken state. ``` So in the last "bad" redo the context got messed up, indicating that we're in edit mode, when we should've been and indeed are in object mode (notice the switches edit-object-edit-**edit**).

Jawad Alshakhs commented

2020-06-30 15:20:12 +02:00

Hi Vincent, thanks for your feedback, great to know legacy undo doesn't have the same issue, I just tried it and it works as expected.

Richard Antalik commented

2020-07-01 02:31:02 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Kevin Buhr commented

2020-07-03 06:03:49 +02:00

Added subscriber: @buhr

Robert Guetzkow commented

2020-07-19 11:10:14 +02:00

Added subscribers: @Phos, @rjg

Hans Goudey commented

2020-09-08 23:04:38 +02:00

Added subscriber: @HooglyBoogly

Hans Goudey commented

2020-09-08 23:04:38 +02:00

I can reproduce this easily by holding down tab so it quickly cycles between modes on the default cube, then undoing a few times, then redoing.

This seems more like an undo bug though, so I'm tagging the correct project.

This also applies to 2.90

I can reproduce this easily by holding down tab so it quickly cycles between modes on the default cube, then undoing a few times, then redoing. This seems more like an undo bug though, so I'm tagging the correct project. This also applies to 2.90

Hans Goudey commented

2020-09-08 23:07:28 +02:00

And 2.83.5 as well

Hans Goudey changed title from ~~Crash on undo/ redo while changing modes~~ to [2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes

2020-09-08 23:08:06 +02:00

Hans Goudey commented

2020-09-11 17:04:41 +02:00

Added subscribers: @WuTangH, @mont29, @JulianEisel, @dfelinto, @lichtwerk, @JerBot, @mano-wii

Bastien Montagne was assigned by Dalai Felinto

2020-09-12 11:53:30 +02:00

Dalai Felinto commented

2020-09-12 11:53:30 +02:00

@HooglyBoogly when merging tasks remember to bring over the relevant information to the one that remains open.

As mentioned in #80377 simpler/exact steps to reproduce as well as assigning to Bastien since it is "new" undo related:

I can reproduce with the following:

Tab
Tab
Tab
Tab
Ctrl + Z (undo)
Shift Ctrl + Z (redo)

@HooglyBoogly when merging tasks remember to bring over the relevant information to the one that remains open. As mentioned in #80377 simpler/exact steps to reproduce as well as assigning to Bastien since it is "new" undo related: I can reproduce with the following: * Tab * Tab * Tab * Tab * Ctrl + Z (undo) * Shift Ctrl + Z (redo)

blender-admin commented

2020-09-14 14:55:48 +02:00

This issue was referenced by 1442827a4f

This issue was referenced by 1442827a4ffc84272fe047931812af7718b90f30

blender-admin commented

2020-09-14 14:55:48 +02:00

This issue was referenced by a4be38c065

This issue was referenced by a4be38c0650bb4006b5c5b2d517503f904de5ed8

blender-admin commented

2020-09-14 14:55:48 +02:00

This issue was referenced by ec6d32b238

This issue was referenced by ec6d32b238da507c258a4b571e332c5cb67a6b18