Property search crash with python handlers #81697

New Issue

Daniel Santana · 2020-10-14T10:27:17+02:00

Daniel Santana commented

2020-10-14 10:27:17 +02:00

System Information
Windows-10-10.0.19041-SP0 64 Bits, Linux 5.8.12-200.fc32.x86_64, Fedora 32 |

Blender Version
Broken: version: 2.91.0 Alpha, branch: master, commit date: 2020-10-14 05:21, hash: 2d4f1afece

Short description of error
When typing on the Property Search textbox Blender crashes to the desktop.

Exact steps for others to reproduce the error

Enable the "Auto Tile Size" addon. Cycles does not need to be registered.
Reopen blender and start typing in the property search box.
In debug builds Blender crashes on the first few characters. In release builds it can require some more typing and deleting. Typing quickly is more likely to cause the crash.

ASAN Report

==440319==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100006afce0 at pc 0x0000034afb76 bp 0x7fffffffc4a0 sp 0x7fffffffc490
READ of size 4 at 0x6100006afce0 thread T0
    - 0 0x34afb75 in ctx_data_get /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302
    - 1 0x34b09dc in ctx_data_pointer_verify /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:394
    - 2 0x34b74ad in CTX_data_scene /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:1043
    - 3 0x60291e0 in rna_Context_scene_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_context.c:146
    - 4 0x602a1e3 in Context_scene_get /home/hans/Documents/Blender-Git/build_linux_debug/source/blender/makesrna/intern/rna_context_gen.c:160
    - 5 0x5eb72f5 in RNA_property_pointer_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_access.c:3725
    - 6 0x69c59cd in pyrna_prop_to_py /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:1577
    - 7 0x69dc4ca in pyrna_struct_getattro /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:4244
    - 8 0x342fb7c in _PyEval_EvalFrameDefault Python/ceval.c:2573
    - 9 0x3429b4a in function_code_fastcall Objects/call.c:283
    - 10 0x342ade4 in call_function Python/ceval.c:4616
    - 11 0x342f4b3 in _PyEval_EvalFrameDefault Python/ceval.c:3124
    - 12 0x3429b4a in function_code_fastcall Objects/call.c:283
    - 13 0x1d851597 in _PyFunction_FastCallDict Objects/call.c:322
    - 14 0x6a1236d in bpy_app_generic_callback /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_app_handlers.c:350
    - 15 0x3483203 in BKE_callback_exec /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:42
    - 16 0x3483577 in BKE_callback_exec_id_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:74
    - 17 0x3ad3bfc in scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1534
    - 18 0x3ad3cb1 in BKE_scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1568
    - 19 0x47216d4 in wm_event_do_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:360
    - 20 0x4721a2a in wm_event_do_refresh_wm_and_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:386
    - 21 0x4723a59 in wm_event_do_notifiers /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:567
    - 22 0x470f39e in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:486
    - 23 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
    - 24 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308
    - 25 0x34335fd in _start (/home/hans/Documents/Blender-Git/build_linux_debug/bin/blender+0x34335fd)

0x6100006afce0 is located 160 bytes inside of 192-byte region [0x6100006afc40,0x6100006afd00)
freed by thread T0 here:
    - 0 0x7ffff766f307 in __interceptor_free (/lib64/libasan.so.6+0xb0307)
    - 1 0x1f1287aa in rem_memblock /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:1019
    - 2 0x1f127774 in MEM_guarded_freeN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:908
    - 3 0x1aeb358c in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:439
    - 4 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454
    - 5 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504
    - 6 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512
    - 7 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684
    - 8 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872
    - 9 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075
    - 10 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489
    - 11 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
    #12 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    - 0 0x7ffff766f667 in __interceptor_malloc (/lib64/libasan.so.6+0xb0667)
    - 1 0x1f1251ca in MEM_guarded_mallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:454
    - 2 0x1f123fa8 in MEM_guarded_dupallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:267
    - 3 0x34ae6a7 in CTX_copy /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:116
    - 4 0x1aeb25a2 in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:404
    - 5 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454
    - 6 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504
    - 7 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512
    - 8 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684
    - 9 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872
    - 10 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075
    - 11 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489
    - 12 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
    - 13 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308

SUMMARY: AddressSanitizer: heap-use-after-free /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302 in ctx_data_get
Shadow bytes around the buggy address:
  0x0c20800cdf40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c20800cdf50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c20800cdf60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c20800cdf70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c20800cdf80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c20800cdf90: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
  0x0c20800cdfa0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c20800cdfb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c20800cdfc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
  0x0c20800cdfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c20800cdfe0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==440319==ABORTING

**System Information** Windows-10-10.0.19041-SP0 64 Bits, Linux 5.8.12-200.fc32.x86_64, Fedora 32 | **Blender Version** Broken: version: 2.91.0 Alpha, branch: master, commit date: 2020-10-14 05:21, hash: `2d4f1afece` **Short description of error** When typing on the Property Search textbox Blender crashes to the desktop. **Exact steps for others to reproduce the error** - Enable the "Auto Tile Size" addon. Cycles does not need to be registered. - Reopen blender and start typing in the property search box. - In debug builds Blender crashes on the first few characters. In release builds it can require some more typing and deleting. Typing quickly is more likely to cause the crash. **ASAN Report** ```lines=10 ==440319==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100006afce0 at pc 0x0000034afb76 bp 0x7fffffffc4a0 sp 0x7fffffffc490 READ of size 4 at 0x6100006afce0 thread T0 - 0 0x34afb75 in ctx_data_get /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302 - 1 0x34b09dc in ctx_data_pointer_verify /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:394 - 2 0x34b74ad in CTX_data_scene /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:1043 - 3 0x60291e0 in rna_Context_scene_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_context.c:146 - 4 0x602a1e3 in Context_scene_get /home/hans/Documents/Blender-Git/build_linux_debug/source/blender/makesrna/intern/rna_context_gen.c:160 - 5 0x5eb72f5 in RNA_property_pointer_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_access.c:3725 - 6 0x69c59cd in pyrna_prop_to_py /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:1577 - 7 0x69dc4ca in pyrna_struct_getattro /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:4244 - 8 0x342fb7c in _PyEval_EvalFrameDefault Python/ceval.c:2573 - 9 0x3429b4a in function_code_fastcall Objects/call.c:283 - 10 0x342ade4 in call_function Python/ceval.c:4616 - 11 0x342f4b3 in _PyEval_EvalFrameDefault Python/ceval.c:3124 - 12 0x3429b4a in function_code_fastcall Objects/call.c:283 - 13 0x1d851597 in _PyFunction_FastCallDict Objects/call.c:322 - 14 0x6a1236d in bpy_app_generic_callback /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_app_handlers.c:350 - 15 0x3483203 in BKE_callback_exec /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:42 - 16 0x3483577 in BKE_callback_exec_id_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:74 - 17 0x3ad3bfc in scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1534 - 18 0x3ad3cb1 in BKE_scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1568 - 19 0x47216d4 in wm_event_do_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:360 - 20 0x4721a2a in wm_event_do_refresh_wm_and_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:386 - 21 0x4723a59 in wm_event_do_notifiers /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:567 - 22 0x470f39e in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:486 - 23 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519 - 24 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308 - 25 0x34335fd in _start (/home/hans/Documents/Blender-Git/build_linux_debug/bin/blender+0x34335fd) 0x6100006afce0 is located 160 bytes inside of 192-byte region [0x6100006afc40,0x6100006afd00) freed by thread T0 here: - 0 0x7ffff766f307 in __interceptor_free (/lib64/libasan.so.6+0xb0307) - 1 0x1f1287aa in rem_memblock /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:1019 - 2 0x1f127774 in MEM_guarded_freeN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:908 - 3 0x1aeb358c in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:439 - 4 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454 - 5 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504 - 6 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512 - 7 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684 - 8 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872 - 9 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075 - 10 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489 - 11 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519 #12 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: - 0 0x7ffff766f667 in __interceptor_malloc (/lib64/libasan.so.6+0xb0667) - 1 0x1f1251ca in MEM_guarded_mallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:454 - 2 0x1f123fa8 in MEM_guarded_dupallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:267 - 3 0x34ae6a7 in CTX_copy /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:116 - 4 0x1aeb25a2 in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:404 - 5 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454 - 6 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504 - 7 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512 - 8 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684 - 9 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872 - 10 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075 - 11 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489 - 12 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519 - 13 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-use-after-free /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302 in ctx_data_get Shadow bytes around the buggy address: 0x0c20800cdf40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c20800cdf50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c20800cdf60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c20800cdf70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c20800cdf80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c20800cdf90: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd 0x0c20800cdfa0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c20800cdfb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c20800cdfc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c20800cdfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c20800cdfe0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==440319==ABORTING ```

Daniel Santana commented

2020-10-14 10:27:18 +02:00

Added subscriber: @dgsantana

Ankit Meel commented

2020-10-14 12:10:46 +02:00

Added subscriber: @ankitm

Ankit Meel commented

2020-10-14 12:10:46 +02:00

Edit: this report is unrelated and was fixed in 1cf8a4e5ea
I don't get a crash in debug build (macOS ), but UB warnings:

source/blender/editors/space_buttons/buttons_context.c:884:50: runtime error:
member access within null pointer of type 'struct Tex'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior

ct->texture is NULL
CTX_data_pointer_set(result, &ct->texture->id, &RNA_Texture, ct->texture);

- 0  buttons_context at source/blender/editors/space_buttons/buttons_context.c:884
- 1  ctx_data_get at source/blender/blenkernel/intern/context.c:351
- 2  CTX_data_get at source/blender/blenkernel/intern/context.c:511
- 3  pyrna_struct_getattro at source/blender/python/intern/bpy_rna.c:4263
- 4  _PyEval_EvalFrameDefault at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Python/ceval.c:2573
- 5  function_code_fastcall at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:283
- 6  _PyFunction_FastCallDict at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:42
- 7  _PyObject_FastCallDict at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:78
- 8  _PyObject_Call_Prepend at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:908
- 9  PyObject_Call at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:245
- 10 bpy_class_call at source/blender/python/intern/bpy_rna.c:8475
- 11 panel_poll at source/blender/makesrna/intern/rna_ui.c:119
- 12 panel_add_check at source/blender/editors/screen/area.c:2789
- 13 ED_region_property_search at source/blender/editors/screen/area.c:3157
- 14 property_search_for_context at source/blender/editors/space_buttons/space_buttons.c:357
- 15 property_search_all_tabs at source/blender/editors/space_buttons/space_buttons.c:429
- 16 buttons_main_region_property_search at source/blender/editors/space_buttons/space_buttons.c:454
- 17 buttons_main_region_layout at source/blender/editors/space_buttons/space_buttons.c:504
- 18 ED_region_do_layout at source/blender/editors/screen/area.c:512
- 19 wm_draw_window_offscreen at source/blender/windowmanager/intern/wm_draw.c:684
- 20 wm_draw_window at source/blender/windowmanager/intern/wm_draw.c:872
- 21 wm_draw_update at source/blender/windowmanager/intern/wm_draw.c:1075
- 22 WM_main at source/blender/windowmanager/intern/wm.c:489
- 23 main at source/creator/creator.c:519

Edit: this report is unrelated and was fixed in 1cf8a4e5ea I don't get a crash in debug build (macOS ), but UB warnings: >source/blender/editors/space_buttons/buttons_context.c:884:50: runtime error: >member access within null pointer of type 'struct Tex' >SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ct->texture is NULL `CTX_data_pointer_set(result, &ct->texture->id, &RNA_Texture, ct->texture);` ```lines=5 - 0 buttons_context at source/blender/editors/space_buttons/buttons_context.c:884 - 1 ctx_data_get at source/blender/blenkernel/intern/context.c:351 - 2 CTX_data_get at source/blender/blenkernel/intern/context.c:511 - 3 pyrna_struct_getattro at source/blender/python/intern/bpy_rna.c:4263 - 4 _PyEval_EvalFrameDefault at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Python/ceval.c:2573 - 5 function_code_fastcall at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:283 - 6 _PyFunction_FastCallDict at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:42 - 7 _PyObject_FastCallDict at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:78 - 8 _PyObject_Call_Prepend at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:908 - 9 PyObject_Call at /Users/brecht/dev/build_darwin/deps/build/python/src/external_python/Objects/call.c:245 - 10 bpy_class_call at source/blender/python/intern/bpy_rna.c:8475 - 11 panel_poll at source/blender/makesrna/intern/rna_ui.c:119 - 12 panel_add_check at source/blender/editors/screen/area.c:2789 - 13 ED_region_property_search at source/blender/editors/screen/area.c:3157 - 14 property_search_for_context at source/blender/editors/space_buttons/space_buttons.c:357 - 15 property_search_all_tabs at source/blender/editors/space_buttons/space_buttons.c:429 - 16 buttons_main_region_property_search at source/blender/editors/space_buttons/space_buttons.c:454 - 17 buttons_main_region_layout at source/blender/editors/space_buttons/space_buttons.c:504 - 18 ED_region_do_layout at source/blender/editors/screen/area.c:512 - 19 wm_draw_window_offscreen at source/blender/windowmanager/intern/wm_draw.c:684 - 20 wm_draw_window at source/blender/windowmanager/intern/wm_draw.c:872 - 21 wm_draw_update at source/blender/windowmanager/intern/wm_draw.c:1075 - 22 WM_main at source/blender/windowmanager/intern/wm.c:489 - 23 main at source/creator/creator.c:519 ```

Ankit Meel commented

2020-10-14 12:11:16 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Dalai Felinto commented

2020-10-14 15:39:07 +02:00

Added subscriber: @dfelinto

Dalai Felinto commented

2020-10-14 15:39:07 +02:00

I could not reproduce it in Linux, it may be Windows only.

Hans Goudey self-assigned this 2020-10-14 15:46:08 +02:00

Hans Goudey commented

2020-10-14 15:47:26 +02:00

I also think the crash is windows only, but I can also reproduce the ASAN report (although I think I remember seeing it before).

Maybe they're related though, I'll see.

I also think the crash is windows only, but I can also reproduce the ASAN report (although I think I remember seeing it before). Maybe they're related though, I'll see.

Julian Eisel commented

2020-10-14 16:33:20 +02:00

Added subscriber: @JulianEisel

Julian Eisel commented

2020-10-14 16:33:20 +02:00

The ASan report should unrelated, it always appears when opening the texture tab.

Properties search basically opens these tabs off-screen, so any errors that usually only appear when opening these will appear on properties search.

The ASan report should unrelated, it always appears when opening the texture tab. Properties search basically opens these tabs off-screen, so any errors that usually only appear when opening these will appear on properties search.

Ankit Meel commented

2020-10-14 17:08:16 +02:00

Changed status from 'Confirmed' to: 'Needs Developer To Reproduce'

Ankit Meel commented

2020-10-14 17:12:27 +02:00

Ray was not able to get a crash on lite build on windows, with fecb276ef7

Ray was not able to get a crash on lite build on windows, with fecb276ef7

Richard Antalik commented

2020-10-14 21:38:05 +02:00

Added subscriber: @iss

Richard Antalik commented

2020-10-14 21:38:05 +02:00

No crash with cf778a9e42 and with 53792e32e7 here.

No crash with cf778a9e42 and with 53792e32e7 here.

Daniel Santana commented

2020-10-14 21:51:48 +02:00

Try enabling the Auto Tile Size addon, @HooglyBoogly, LazyDodo and me found out that the cause is something that an addon adds to the properties.

Hans Goudey commented

2020-10-14 23:20:17 +02:00

Changed status from 'Needs Developer To Reproduce' to: 'Confirmed'

Hans Goudey commented

2020-10-14 23:20:17 +02:00

Indeed, enabling the auto tile size addon causes property search to crash. The problem is in property_search_all_tabs, where a new context is created with CTX_copy(), then freed at the end of the function.

Apparently in the next main loop, that context is still around and is accessed in wm_event_do_notifiers. I'm guessing this is because of this line in the addon: bpy.app.handlers.depsgraph_update_post.append(on_scene_update)

My best guess is that somehow using the duplicated context sets the bpy.context variable, which is then reused in the next main loop.

Indeed, enabling the auto tile size addon causes property search to crash. The problem is in `property_search_all_tabs`, where a new context is created with `CTX_copy()`, then freed at the end of the function. Apparently in the next main loop, that context is still around and is accessed in `wm_event_do_notifiers`. I'm guessing this is because of this line in the addon: `bpy.app.handlers.depsgraph_update_post.append(on_scene_update)` My best guess is that somehow using the duplicated context sets the `bpy.context` variable, which is then reused in the next main loop.

Hans Goudey changed title from ~~Crash when typing on the new property search~~ to Property search crash with python handlers

2020-10-14 23:21:52 +02:00

blender-admin commented

2020-10-15 17:08:39 +02:00

This issue was referenced by e7ab802ab0

This issue was referenced by e7ab802ab04d25532ee16153c55eaac290c877b0

Hans Goudey commented

2020-10-15 17:09:34 +02:00

Changed status from 'Confirmed' to: 'Resolved'

Hans Goudey closed this issue

2020-10-15 17:09:34 +02:00

Thomas Dinges added this to the 2.91 milestone 2023-02-08 16:20:10 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Property search crash with python handlers #81697