Crash when using Mirror with Source set to Verts in particle edit mode #84142

New Issue

Sebastian · 2020-12-26T01:08:58+01:00

Sebastian commented

2020-12-26 01:08:58 +01:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1080 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 457.30

Blender Version
Broken: version:

2.83.10, branch: master, commit date: 2020-12-07 14:09, hash: b439a15544
2.91.0, branch: master, commit date: 2020-11-25 08:34, hash: 0f45cab862
2.92.0 Alpha, branch: master, commit date: 2020-12-24 19:11, hash: `af316d2761

Short description of error

Open Blender with the default startup scene
Select a cube and go to particle Properties
Add Particle System Slot
Change the particle type from Emitter to Hair
In the Source section, set Emit From to Verts
Go to Edit particle mode
Select all the particles with A key
In Particle settings, and turn on the Mirror option

Blender should crash.

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: GeForce GTX 1080 Ti/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 457.30 **Blender Version** Broken: version: - 2.83.10, branch: master, commit date: 2020-12-07 14:09, hash: `b439a15544` - 2.91.0, branch: master, commit date: 2020-11-25 08:34, hash: `0f45cab862` - 2.92.0 Alpha, branch: master, commit date: 2020-12-24 19:11, hash: `af316d2761 **Short description of error** - Open Blender with the default startup scene - Select a cube and go to particle Properties - Add Particle System Slot - Change the particle type from Emitter to Hair - In the Source section, set Emit From to Verts - Go to Edit particle mode - Select all the particles with A key - In Particle settings, and turn on the Mirror option Blender should crash.

Sebastian commented

2020-12-26 01:08:58 +01:00

Added subscriber: @sebus_93

Jean First commented

2020-12-26 13:28:28 +01:00

Added subscriber: @robbott

Jean First commented

2020-12-26 13:28:28 +01:00

Open the following file and click in the viewport menu "Particle > Mirror" -> crash.
Confirmed on version: 2.92.0 Alpha, branch: master, commit date: 2020-12-25 22:13, hash: 8491e4ab86

#84142.blend

blender!psys_particle_dm_face_lookup (/Users/*/devel/blender-git/blender/source/blender/blenkernel/intern/particle.c:1939)
blender!PE_mirror_x (/Users/*/devel/blender-git/blender/source/blender/editors/physics/particle_edit.c:3454)
blender!mirror_exec (/Users/*/devel/blender-git/blender/source/blender/editors/physics/particle_edit.c:3487)
blender!wm_operator_invoke (/Users/*/devel/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1312)
[...]

Open the following file and click in the viewport menu "Particle > Mirror" -> crash. Confirmed on version: 2.92.0 Alpha, branch: master, commit date: 2020-12-25 22:13, hash: `8491e4ab86` [#84142.blend](https://archive.blender.org/developer/F9530838/T84142.blend) ``` blender!psys_particle_dm_face_lookup (/Users/*/devel/blender-git/blender/source/blender/blenkernel/intern/particle.c:1939) blender!PE_mirror_x (/Users/*/devel/blender-git/blender/source/blender/editors/physics/particle_edit.c:3454) blender!mirror_exec (/Users/*/devel/blender-git/blender/source/blender/editors/physics/particle_edit.c:3487) blender!wm_operator_invoke (/Users/*/devel/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1312) [...] ```

Damien Smith commented

2020-12-27 10:01:14 +01:00

Added subscriber: @idomo-1

Damien Smith commented

2020-12-27 10:01:14 +01:00

Here's what I think may be causing this crash
Suppose we are using the default cube, which has 8 vertices and 6 faces
The function PE_mirror_x in particle_edit.c gets this array

3350 mirrorfaces = mesh_get_x_mirror_faces(
3351       ob, NULL, use_dm_final_indices ? psmd_eval->mesh_final : NULL);

The function mesh_get_x_mirror_faces in meshtools.c returns an array which is populated up to 2 * total faces of the mesh + 1 = 2 * 6 + 1 = 13

mirrormf.v1 = mirrorverts[mf->v3];
mirrormf.v2 = mirrorverts[mf->v2];
mirrormf.v3 = mirrorverts[mf->v1];
mirrormf.v4 = (mf->v4) ? mirrorverts[mf->v4] : 0;

/* make sure v4 is not 0 if a quad */
if (mf->v4 && mirrormf.v4 == 0) {
SWAP(uint, mirrormf.v1, mirrormf.v3);
SWAP(uint, mirrormf.v2, mirrormf.v4);
}

hashmf = BLI_ghash_lookup(fhash, &mirrormf);
if (hashmf) {
mirrorfaces[a * 2] = hashmf - mface;
mirrorfaces[a * 2 + 1] = mirror_facerotation(&mirrormf, hashmf);
}
else {
mirrorfaces[a * 2] = -1;
}
}

BLI_ghash_free(fhash, NULL, NULL);
MEM_freeN(mirrorverts);

return mirrorfaces;

Then this array gets indexed using pa->num * 2 where pa->num is the vertex index I think?

3448 newpa->num = mirrorfaces[pa_num * 2];

Since there are 8 vertices (i.e pa_num=7, 7*2 = 14), this accesses garbage
This garbage value ends up being passed to psys_particle_dm_face_lookup in particle.c, and causes a seg fault on this line

1939 pindex_orig = index_mf_to_mpoly_deformed[findex_orig];

Here's the backtrace for more context

#0  psys_particle_dm_face_lookup (mesh_final=0x7fffc9611808, mesh_original=0x0, findex_orig=328425568, fw=0x7fffb78f3220, poly_nodes=0x0)
    at /home/damien/blender-git/blender/source/blender/blenkernel/intern/particle.c:1939
#1  0x00000000047ecda2 in PE_mirror_x (depsgraph=0x7fffd097ba08, scene=0x7ffff5372808, ob=0x7ffff4dd9808, tagged=0)
    at /home/damien/blender-git/blender/source/blender/editors/physics/particle_edit.c:3454
#2  0x00000000047ecf8f in mirror_exec (C=0x7ffff470bee8, UNUSED_op=0x7fffc6fa2d88)
    at /home/damien/blender-git/blender/source/blender/editors/physics/particle_edit.c:3487
#3  0x00000000039c2af2 in wm_operator_invoke
    (C=0x7ffff470bee8, ot=0x7ffff4b80928, event=0x7ffff4ddd968, properties=0x7fffffffd7f0, reports=0x0, poll_only=false, use_last_properties=true)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1312
#4  0x00000000039c3158 in wm_operator_call_internal
    (C=0x7ffff470bee8, ot=0x7ffff4b80928, properties=0x7fffffffd7f0, reports=0x0, context=1, poll_only=false, event=0x7ffff4ddd968)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1507
#5  0x00000000039c3359 in WM_operator_name_call_ptr (C=0x7ffff470bee8, ot=0x7ffff4b80928, context=1, properties=0x7fffffffd7f0)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1555
- 6  0x000000000497a3df in ui_apply_but_funcs_after (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/editors/interface/interface_handlers.c:939
- 7  0x0000000004995ebf in ui_handler_region_menu (C=0x7ffff470bee8, event=0x7fffc6fa6408, UNUSED_userdata=0x7fffbbeede88)
    at /home/damien/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10848
#8  0x00000000039c0ed1 in wm_handler_ui_call (C=0x7ffff470bee8, handler=0x7fffbe46e648, event=0x7fffc6fa6408, always_pass=0)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:643
#9  0x00000000039c69d1 in wm_handlers_do_intern (C=0x7ffff470bee8, event=0x7fffc6fa6408, handlers=0x7fffed984298)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2778
#10 0x00000000039c6e48 in wm_handlers_do (C=0x7ffff470bee8, event=0x7fffc6fa6408, handlers=0x7fffed984298)
    at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886
- 11 0x00000000039c8227 in wm_event_do_handlers (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3309
- 12 0x00000000039bbb41 in WM_main (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
#13 0x00000000033aad15 in main (argc=1, argv=0x7fffffffde18) at /home/damien/blender-git/blender/source/creator/creator.c:522

Here's what I think may be causing this crash Suppose we are using the default cube, which has 8 vertices and 6 faces The function `PE_mirror_x` in `particle_edit.c` gets this array ``` 3350 mirrorfaces = mesh_get_x_mirror_faces( 3351 ob, NULL, use_dm_final_indices ? psmd_eval->mesh_final : NULL); ``` The function `mesh_get_x_mirror_faces` in `meshtools.c` returns an array which is populated up to 2 * total faces of the mesh + 1 = 2 * 6 + 1 = 13 ```for (a = 0, mf = mface; a < totface; a++, mf++) { ``` mirrormf.v1 = mirrorverts[mf->v3]; mirrormf.v2 = mirrorverts[mf->v2]; mirrormf.v3 = mirrorverts[mf->v1]; mirrormf.v4 = (mf->v4) ? mirrorverts[mf->v4] : 0; ``` ``` /* make sure v4 is not 0 if a quad */ if (mf->v4 && mirrormf.v4 == 0) { SWAP(uint, mirrormf.v1, mirrormf.v3); SWAP(uint, mirrormf.v2, mirrormf.v4); } ``` ``` hashmf = BLI_ghash_lookup(fhash, &mirrormf); if (hashmf) { mirrorfaces[a * 2] = hashmf - mface; mirrorfaces[a * 2 + 1] = mirror_facerotation(&mirrormf, hashmf); } else { mirrorfaces[a * 2] = -1; } } ``` ``` BLI_ghash_free(fhash, NULL, NULL); MEM_freeN(mirrorverts); ``` ``` return mirrorfaces; ``` ``` Then this array gets indexed using `pa->num * 2` where `pa->num` is the vertex index I think? ``` 3448 newpa->num = mirrorfaces[pa_num * 2]; ``` Since there are 8 vertices (i.e pa_num=7, 7*2 = 14), this accesses garbage This garbage value ends up being passed to `psys_particle_dm_face_lookup` in `particle.c`, and causes a seg fault on this line ``` 1939 pindex_orig = index_mf_to_mpoly_deformed[findex_orig]; ``` Here's the backtrace for more context ``` #0 psys_particle_dm_face_lookup (mesh_final=0x7fffc9611808, mesh_original=0x0, findex_orig=328425568, fw=0x7fffb78f3220, poly_nodes=0x0) at /home/damien/blender-git/blender/source/blender/blenkernel/intern/particle.c:1939 #1 0x00000000047ecda2 in PE_mirror_x (depsgraph=0x7fffd097ba08, scene=0x7ffff5372808, ob=0x7ffff4dd9808, tagged=0) at /home/damien/blender-git/blender/source/blender/editors/physics/particle_edit.c:3454 #2 0x00000000047ecf8f in mirror_exec (C=0x7ffff470bee8, UNUSED_op=0x7fffc6fa2d88) at /home/damien/blender-git/blender/source/blender/editors/physics/particle_edit.c:3487 #3 0x00000000039c2af2 in wm_operator_invoke (C=0x7ffff470bee8, ot=0x7ffff4b80928, event=0x7ffff4ddd968, properties=0x7fffffffd7f0, reports=0x0, poll_only=false, use_last_properties=true) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1312 #4 0x00000000039c3158 in wm_operator_call_internal (C=0x7ffff470bee8, ot=0x7ffff4b80928, properties=0x7fffffffd7f0, reports=0x0, context=1, poll_only=false, event=0x7ffff4ddd968) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1507 #5 0x00000000039c3359 in WM_operator_name_call_ptr (C=0x7ffff470bee8, ot=0x7ffff4b80928, context=1, properties=0x7fffffffd7f0) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1555 - 6 0x000000000497a3df in ui_apply_but_funcs_after (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/editors/interface/interface_handlers.c:939 - 7 0x0000000004995ebf in ui_handler_region_menu (C=0x7ffff470bee8, event=0x7fffc6fa6408, UNUSED_userdata=0x7fffbbeede88) at /home/damien/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10848 #8 0x00000000039c0ed1 in wm_handler_ui_call (C=0x7ffff470bee8, handler=0x7fffbe46e648, event=0x7fffc6fa6408, always_pass=0) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:643 #9 0x00000000039c69d1 in wm_handlers_do_intern (C=0x7ffff470bee8, event=0x7fffc6fa6408, handlers=0x7fffed984298) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2778 #10 0x00000000039c6e48 in wm_handlers_do (C=0x7ffff470bee8, event=0x7fffc6fa6408, handlers=0x7fffed984298) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886 - 11 0x00000000039c8227 in wm_event_do_handlers (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3309 - 12 0x00000000039bbb41 in WM_main (C=0x7ffff470bee8) at /home/damien/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 #13 0x00000000033aad15 in main (argc=1, argv=0x7fffffffde18) at /home/damien/blender-git/blender/source/creator/creator.c:522 ```

Philipp Oeser commented

2020-12-27 14:52:35 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2020-12-27 14:52:35 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Philipp Oeser commented

2020-12-27 14:52:35 +01:00

Can also confirm, even 2.79b crashed here.

Thx investigating @idomo-1 !

Can also confirm, even 2.79b crashed here. Thx investigating @idomo-1 !

Philipp Oeser changed title from ~~Crash when using Mirror with Sours set to Verts in particle edit mode~~ to Crash when using Mirror with Source set to Verts in particle edit mode

2020-12-27 14:53:06 +01:00

Philipp Oeser commented

2020-12-27 15:06:54 +01:00

Not sure if this has still chances to get fixed [since old particles and old hair are EOL], but there are a couple of places that get face indices back when emission takes place from vertices.
Look for these comments:

/* This finds the first face to contain the emitting vertex

Not sure if this has still chances to get fixed [since old particles and old hair are EOL], but there are a couple of places that get face indices back when emission takes place from vertices. Look for these comments: > /* This finds the first face to contain the emitting vertex

Jacques Lucke commented

2021-01-05 12:23:08 +01:00

Added subscriber: @JacquesLucke

Jacques Lucke commented

2021-01-05 12:23:08 +01:00

The mirrorfaces[pa->num * 2] expression seems to suggest that the PE_mirror_x has been designed to work only when pa->num is a face index. I think the short term fix is to change disable the operator in other cases.

The `mirrorfaces[pa->num * 2]` expression seems to suggest that the `PE_mirror_x` has been designed to work only when `pa->num` is a face index. I think the short term fix is to change disable the operator in other cases.

blender-admin commented

2021-01-07 13:32:36 +01:00

This issue was referenced by c55b578c9e

This issue was referenced by c55b578c9e1f4f5d03fbac01c7efa070e1d6970d

Jacques Lucke commented

2021-01-07 13:33:34 +01:00

Changed status from 'Confirmed' to: 'Resolved'

Jacques Lucke closed this issue

2021-01-07 13:33:34 +01:00

Jacques Lucke self-assigned this 2021-01-07 13:33:34 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when using Mirror with Source set to Verts in particle edit mode #84142