[2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes #78392

Closed
opened 3 years ago by jshakhs · 18 comments

System Information
Operating system: Windows-10-10.0.18362-SP0 64 Bits
Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 442.19

Blender Version
Broken: version: 2.90.0 Alpha, branch: master, commit date: 2020-06-27 21:56, hash: 59d2dd2237
Broken: version: 2.83.1, branch: master, commit date: 2020-06-25 09:47, hash: 8289fc688b
Worked: 2.82 (sub 7), branch: master, commit date: 2020-02-12 16:20, hash: 77d23b0bd7

Short description of error
Crashes when undo/ redo enters and exits different modes; tested with object and edit mode on default startup file and consistently crashes.

Exact steps for others to reproduce the error

  • select default cube and press (tab) several times to cycle modes from object to edit mode (3-4 times or more)
  • undo shortcut (ctrl z) several times (3-4 times or more causes crash)
  • redo shortcut (ctrl shift z) crashes blender (always crashes on the 3rd or 4th redo on my system)

Based on the default 2.83.1 and 2.9 startup files; tested on 2.82 with 256 undo/ redo steps without any crashes.

**System Information** Operating system: Windows-10-10.0.18362-SP0 64 Bits Graphics card: GeForce GTX 1080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 442.19 **Blender Version** Broken: version: 2.90.0 Alpha, branch: master, commit date: 2020-06-27 21:56, hash: `59d2dd2237` Broken: version: 2.83.1, branch: master, commit date: 2020-06-25 09:47, hash: `8289fc688b` Worked: 2.82 (sub 7), branch: master, commit date: 2020-02-12 16:20, hash: `77d23b0bd7` **Short description of error** Crashes when undo/ redo enters and exits different modes; tested with object and edit mode on default startup file and consistently crashes. **Exact steps for others to reproduce the error** - select default cube and press (tab) several times to cycle modes from object to edit mode (3-4 times or more) - undo shortcut (ctrl z) several times (3-4 times or more causes crash) - redo shortcut (ctrl shift z) crashes blender (always crashes on the 3rd or 4th redo on my system) Based on the default 2.83.1 and 2.9 startup files; tested on 2.82 with 256 undo/ redo steps without any crashes.
Poster

Added subscriber: @jshakhs

Added subscriber: @jshakhs
Owner

#80377 was marked as duplicate of this issue

#80377 was marked as duplicate of this issue
Owner

#79049 was marked as duplicate of this issue

#79049 was marked as duplicate of this issue

Added subscriber: @VincentBlankfield

Added subscriber: @VincentBlankfield

Reproduced. Crashes on redo. No crash with Preferences > Experimental > Undo Legacy.

Stack trace:

>	ui_but_value_get(but=0x000001b9137e2e48) Line 2378

 	ui_but_is_pushed_ex(but=0x000001b9137e2e48, value=0x00000063c4bfea70) Line 2002
 	[Inline Frame] ui_but_update_select_flag() Line 2086
 	ui_but_update_ex(but=0x000001b9137e2e48, validate) Line 3506
 	[Inline Frame] ui_but_update() Line 3676
 	[Inline Frame] ui_but_update_and_icon_set() Line 4631
 	uiDefIconBut(block, type, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5019
 	uiDefIconButBit(block=0x000001b9137b3a38, type, bit, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5057
 	uiTemplateEditModeSelection(layout=0x000001b913436f68, C) Line 162
 	uiTemplateHeader3D_mode(layout=0x000001b913436f68, C=0x000001b904858c18) Line 238
 	RNA_function_call(C, reports, ptr, func, parms=0x00000063c4bfef88) Line 7494
 	pyrna_func_call(self, args, kw=0x0000000000000000) Line 6328
 	[External Code]	
 	bpy_class_call(C=0x000001b904858c18, ptr=0x00000063c4bff950, func=0x00007ff6ceeff300, parms=0x00000063c4bff968) Line 8513
 	header_draw(C=0x000001b904858c18, hdr=0x00000063c4bff9f0) Line 707
 	ED_region_header_layout(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2872
 	ED_region_header(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2935
 	ED_region_do_draw(C=0x000001b904858c18, region=0x000001b9074367f8) Line 543
 	wm_draw_window_offscreen(C=0x000001b904858c18, win=0x000001b906eaa2b8, stereo) Line 713
 	wm_draw_window(C=0x000001b904858c18, win=0x000001b906eaa2b8) Line 841
 	wm_draw_update(C=0x000001b904858c18) Line 1042
 	WM_main(C=0x000001b904858c18) Line 482
 	main(argc=1, UNUSED_argv_c=0x0000000000000000) Line 534
 	[External Code]	

This:

diff --git a/source/blender/editors/space_view3d/view3d_header.c b/source/blender/editors/space_view3d/view3d_header.c
index f2e42cd1725..3668c3060a2 100644
--- a/source/blender/editors/space_view3d/view3d_header.c
+++ b/source/blender/editors/space_view3d/view3d_header.c
@@ -136,11 +136,34 @@ void uiTemplateEditModeSelection(uiLayout *layout, struct bContext *C)

   UI_block_func_handle_set(block, do_view3d_header_buttons, NULL);

+  ********************************************//
+  printf("Entered uiTemplateEditModeSelection in %s\n", CTX_data_mode_string(C));
+  ********************************************//
+
   if (obedit && (obedit->type == OB_MESH)) {
     BMEditMesh *em = BKE_editmesh_from_object(obedit);
     uiLayout *row;
     uiBut *but;

+    ********************************************//
+    if (BKE_editmesh_from_object(CTX_data_edit_object(C)) == NULL) {
+      printf("Context says we're in %s\n", CTX_data_mode_string(C));
+      printf("But there's no edit object editmesh\n");
+      printf("em=%x, &em-selectmode=%x\n", em, &em->selectmode);
+      printf("If we continue execution, we will crash in ui_but_value_get() Line 2378\n");
+      printf("Because it will try to access (short *)but->poin\n");
+      printf("which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode\n");
+      printf("and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL\n");
+      printf("So I'm going to return now.\n");
+      printf("Notice how the viewport mode button is now broken.\n");
+      printf("Also all further redos will fail here.\n");
+      printf("An attempt to switch the mode (using tab or the button) may crash or recover\n");
+      printf("from this broken state.\n");
+      return;
+    }
+    ********************************************//
+
     row = uiLayoutRow(layout, true);
     block = uiLayoutGetBlock(row);
     but = uiDefIconButBitS(

will give following output (just hitting Ctrl+Shift+Z after tabbing a bunch of times, and undoing it all):

Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in objectmode
Entered uiTemplateEditModeSelection in mesh_edit
Entered uiTemplateEditModeSelection in mesh_edit
Context says we're in mesh_edit
But there's no edit object editmesh
em=0, &em-selectmode=68
If we continue execution, we will crash in ui_but_value_get() Line 2378
Because it will try to access (short *)but->poin
which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode
and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL
So I'm going to return now.
Notice how the viewport mode button is now broken.
Also all further redos will fail here.
An attempt to switch the mode (using tab or the button) may crash or recover
from this broken state.

So in the last "bad" redo the context got messed up, indicating that we're in edit mode, when we should've been and indeed are in object mode (notice the switches edit-object-edit-edit).

Reproduced. Crashes on redo. No crash with `Preferences > Experimental > Undo Legacy`. Stack trace: ``` > ui_but_value_get(but=0x000001b9137e2e48) Line 2378 ui_but_is_pushed_ex(but=0x000001b9137e2e48, value=0x00000063c4bfea70) Line 2002 [Inline Frame] ui_but_update_select_flag() Line 2086 ui_but_update_ex(but=0x000001b9137e2e48, validate) Line 3506 [Inline Frame] ui_but_update() Line 3676 [Inline Frame] ui_but_update_and_icon_set() Line 4631 uiDefIconBut(block, type, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5019 uiDefIconButBit(block=0x000001b9137b3a38, type, bit, retval, icon=546, x=0, y=0, width=20, height=20, poin=0x0000000000000068, min=1.00000000, max=0.000000000, a1=0.000000000, a2=0.000000000, tip=0x00007ff6cd3022b0) Line 5057 uiTemplateEditModeSelection(layout=0x000001b913436f68, C) Line 162 uiTemplateHeader3D_mode(layout=0x000001b913436f68, C=0x000001b904858c18) Line 238 RNA_function_call(C, reports, ptr, func, parms=0x00000063c4bfef88) Line 7494 pyrna_func_call(self, args, kw=0x0000000000000000) Line 6328 [External Code] bpy_class_call(C=0x000001b904858c18, ptr=0x00000063c4bff950, func=0x00007ff6ceeff300, parms=0x00000063c4bff968) Line 8513 header_draw(C=0x000001b904858c18, hdr=0x00000063c4bff9f0) Line 707 ED_region_header_layout(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2872 ED_region_header(C=0x000001b904858c18, region=0x000001b9074367f8) Line 2935 ED_region_do_draw(C=0x000001b904858c18, region=0x000001b9074367f8) Line 543 wm_draw_window_offscreen(C=0x000001b904858c18, win=0x000001b906eaa2b8, stereo) Line 713 wm_draw_window(C=0x000001b904858c18, win=0x000001b906eaa2b8) Line 841 wm_draw_update(C=0x000001b904858c18) Line 1042 WM_main(C=0x000001b904858c18) Line 482 main(argc=1, UNUSED_argv_c=0x0000000000000000) Line 534 [External Code] ``` This: ``` diff --git a/source/blender/editors/space_view3d/view3d_header.c b/source/blender/editors/space_view3d/view3d_header.c index f2e42cd1725..3668c3060a2 100644 --- a/source/blender/editors/space_view3d/view3d_header.c +++ b/source/blender/editors/space_view3d/view3d_header.c @@ -136,11 +136,34 @@ void uiTemplateEditModeSelection(uiLayout *layout, struct bContext *C) UI_block_func_handle_set(block, do_view3d_header_buttons, NULL); + ********************************************// + printf("Entered uiTemplateEditModeSelection in %s\n", CTX_data_mode_string(C)); + ********************************************// + if (obedit && (obedit->type == OB_MESH)) { BMEditMesh *em = BKE_editmesh_from_object(obedit); uiLayout *row; uiBut *but; + ********************************************// + if (BKE_editmesh_from_object(CTX_data_edit_object(C)) == NULL) { + printf("Context says we're in %s\n", CTX_data_mode_string(C)); + printf("But there's no edit object editmesh\n"); + printf("em=%x, &em-selectmode=%x\n", em, &em->selectmode); + printf("If we continue execution, we will crash in ui_but_value_get() Line 2378\n"); + printf("Because it will try to access (short *)but->poin\n"); + printf("which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode\n"); + printf("and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL\n"); + printf("So I'm going to return now.\n"); + printf("Notice how the viewport mode button is now broken.\n"); + printf("Also all further redos will fail here.\n"); + printf("An attempt to switch the mode (using tab or the button) may crash or recover\n"); + printf("from this broken state.\n"); + return; + } + ********************************************// + row = uiLayoutRow(layout, true); block = uiLayoutGetBlock(row); but = uiDefIconButBitS( ``` will give following output (just hitting `Ctrl+Shift+Z` after tabbing a bunch of times, and undoing it all): ``` Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in objectmode Entered uiTemplateEditModeSelection in mesh_edit Entered uiTemplateEditModeSelection in mesh_edit Context says we're in mesh_edit But there's no edit object editmesh em=0, &em-selectmode=68 If we continue execution, we will crash in ui_but_value_get() Line 2378 Because it will try to access (short *)but->poin which is BKE_editmesh_from_object(CTX_data_edit_object(C))->selectmode and BKE_editmesh_from_object(CTX_data_edit_object(C)) is NULL So I'm going to return now. Notice how the viewport mode button is now broken. Also all further redos will fail here. An attempt to switch the mode (using tab or the button) may crash or recover from this broken state. ``` So in the last "bad" redo the context got messed up, indicating that we're in edit mode, when we should've been and indeed are in object mode (notice the switches edit-object-edit-**edit**).
Poster

Hi Vincent, thanks for your feedback, great to know legacy undo doesn't have the same issue, I just tried it and it works as expected.

Hi Vincent, thanks for your feedback, great to know legacy undo doesn't have the same issue, I just tried it and it works as expected.
iss commented 3 years ago
Collaborator

Changed status from 'Needs Triage' to: 'Confirmed'

Changed status from 'Needs Triage' to: 'Confirmed'
buhr commented 3 years ago

Added subscriber: @buhr

Added subscriber: @buhr
rjg commented 3 years ago
Collaborator

Added subscribers: @Phos, @rjg

Added subscribers: @Phos, @rjg
Collaborator

Added subscriber: @HooglyBoogly

Added subscriber: @HooglyBoogly
Collaborator

I can reproduce this easily by holding down tab so it quickly cycles between modes on the default cube, then undoing a few times, then redoing.

This seems more like an undo bug though, so I'm tagging the correct project.

This also applies to 2.90

I can reproduce this easily by holding down tab so it quickly cycles between modes on the default cube, then undoing a few times, then redoing. This seems more like an undo bug though, so I'm tagging the correct project. This also applies to 2.90
Collaborator

And 2.83.5 as well

And 2.83.5 as well
HooglyBoogly changed title from Crash on undo/ redo while changing modes to [2.83.5, 2.90, 2.91] Crash on undo/ redo after changing modes 2 years ago
Collaborator
Added subscribers: @WuTangH, @mont29, @JulianEisel, @dfelinto, @lichtwerk, @JerBot, @mano-wii
mont29 was assigned by dfelinto 2 years ago
Owner

@HooglyBoogly when merging tasks remember to bring over the relevant information to the one that remains open.

As mentioned in #80377 simpler/exact steps to reproduce as well as assigning to Bastien since it is "new" undo related:

I can reproduce with the following:

  • Tab
  • Tab
  • Tab
  • Tab
  • Ctrl + Z (undo)
  • Shift Ctrl + Z (redo)
@HooglyBoogly when merging tasks remember to bring over the relevant information to the one that remains open. As mentioned in #80377 simpler/exact steps to reproduce as well as assigning to Bastien since it is "new" undo related: I can reproduce with the following: * Tab * Tab * Tab * Tab * Ctrl + Z (undo) * Shift Ctrl + Z (redo)
Owner

This issue was referenced by 1442827a4f

This issue was referenced by 1442827a4ffc84272fe047931812af7718b90f30
Owner

This issue was referenced by a4be38c065

This issue was referenced by a4be38c0650bb4006b5c5b2d517503f904de5ed8
Owner

This issue was referenced by ec6d32b238

This issue was referenced by ec6d32b238da507c258a4b571e332c5cb67a6b18
mont29 commented 2 years ago
Owner

Changed status from 'Confirmed' to: 'Resolved'

Changed status from 'Confirmed' to: 'Resolved'
mont29 closed this issue 2 years ago
Sign in to join this conversation.
No Label
good first issue
legacy module/Animation & Rigging
legacy module/Core
legacy module/Development Management
legacy module/Eevee & Viewport
legacy module/Grease Pencil
legacy module/Modeling
legacy module/Nodes & Physics
legacy module/Pipeline, Assets & IO
legacy module/Platforms, Builds, Tests & Devices
legacy module/Python API
legacy module/Rendering & Cycles
legacy module/Sculpt, Paint & Texture
legacy module/Triaging
legacy module/User Interface
legacy module/VFX & Video
legacy project/1.0.0-beta.2
legacy project/2.81
legacy project/2.82
legacy project/2.83
legacy project/2.90
legacy project/2.91
legacy project/2.92
legacy project/3.0
legacy project/3.1
legacy project/3.2
legacy project/3.3
legacy project/Alembic
legacy project/Animation & Rigging
legacy project/Asset Browser
legacy project/Asset Browser (Archived)
legacy project/Asset Browser Project Overview
legacy project/Audio
legacy project/Automated Testing
legacy project/BF Blender: 2.8
legacy project/BF Blender: After Release
legacy project/BF Blender: Next
legacy project/BF Blender: Regressions
legacy project/BF Blender: Unconfirmed
legacy project/Blender 2.70
legacy project/Blender Asset Bundle
legacy project/Code Quest
legacy project/Collada
legacy project/Compositing
legacy project/Core
legacy project/Cycles
legacy project/Datablocks and Libraries
legacy project/Dependency Graph
legacy project/Development Management
legacy project/Eevee
legacy project/EEVEE & Viewport
legacy project/Freestyle
legacy project/Game Animation
legacy project/Game Audio
legacy project/Game Data Conversion
legacy project/Game Engine
legacy project/Game Logic
legacy project/Game Physics
legacy project/Game Python
legacy project/Game Rendering
legacy project/Game UI
legacy project/Geometry Nodes
legacy project/Good First Issue
legacy project/GPU / Viewport
legacy project/Grease Pencil
legacy project/GSoC
legacy project/Images & Movies
legacy project/Import/Export
legacy project/Infrastructure: Websites
legacy project/LibOverrides - Usability and UX
legacy project/Line Art
legacy project/Masking
legacy project/Milestone 1: Basic, Local Asset Browser
legacy project/Modeling
legacy project/Modifiers
legacy project/Motion Tracking
legacy project/Nodes
legacy project/Nodes & Physics
legacy project/OpenGL Error
legacy project/Overrides
legacy project/Papercut
legacy project/Performance
legacy project/Physics
legacy project/Pipeline, Assets & I/O
legacy project/Platform: FreeBSD
legacy project/Platform: Linux
legacy project/Platform: macOS
legacy project/Platforms, Builds, Tests & Devices
legacy project/Platform: Windows
legacy project/Pose Library Basics
legacy project/Python API
legacy project/Render & Cycles
legacy project/Render Pipeline
legacy project/Retrospective
legacy project/Sculpt, Paint & Texture
legacy project/Text Editor
legacy project/Tracker Curfew
legacy project/Translations
legacy project/Triaging
legacy project/Undo
legacy project/USD
legacy project/User Interface
legacy project/UV Editing
legacy project/VFX & Video
legacy project/Video Sequencer
legacy project/Virtual Reality
legacy project/Wintab High Frequency
migration/requires-manual-verification
Module › Animation & Rigging
Module › Core
Module › Development Management
Module › Eevee & Viewport
Module › EEVEE & Viewport
Module › Grease Pencil
Module › Modeling
Module › Nodes & Physics
Module › Pipeline, Assets & IO
Module › Platforms, Builds Tests & Devices
Module › Platforms, Builds, Tests & Devices
Module › Python API
Module › Rendering & Cycles
Module › Sculpt, Paint & Texture
Module › Triaging
Module › User Interface
Module › VFX & Video
papercut
performance
Priority › High
Priority › Low
Priority › Normal
Priority › Unbreak Now!
Status › Archived
Status › Confirmed
Status › Duplicate
Status › Needs Information from Developers
Status › Needs Information from User
Status › Needs Triage
Status › Resolved
Type › Bug
Type › Design
Type › Known Issue
Type › Patch
Type › Report
Type › To Do
No Milestone
No project
No Assignees
9 Participants
Notifications
Due Date

No due date set.

Dependencies

No dependencies set.

Reference: blender/blender#78392
Loading…
There is no content yet.