Crash when painting a rigged model while it is playing an animation #84532

New Issue

Diogo Valadares Reis dos Santos · 2021-01-08T18:31:20+01:00

Diogo Valadares Reis dos Santos commented

2021-01-08 18:31:20 +01:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: AMD Radeon RX 5700 XT ATI Technologies Inc. 4.5.14757 Core Profile Context 20.12.1 27.20.14501.28009

Blender Version
Broken:

2.92.0 Alpha, branch: master, commit date: 2021-01-08 10:20, hash: 03f1d8acab
2.91.0
2.90.1
Worked: ?

Exact steps for others to reproduce the error

so, this is a problem that has been in blender for a while, but I never saw any reason to report it since probably nobody paints a model while its being animated.

the problem works more easily on texture paint mode, tho I think I got it in weight and vertex paint mode in higher poly meshes.

2021-01-08 14-25-54.mp4
bug.blend
blender_system_info.txt
blender_debug_output.txt

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: AMD Radeon RX 5700 XT ATI Technologies Inc. 4.5.14757 Core Profile Context 20.12.1 27.20.14501.28009 **Blender Version** Broken: - 2.92.0 Alpha, branch: master, commit date: 2021-01-08 10:20, hash: `03f1d8acab` - 2.91.0 - 2.90.1 Worked: ? **Exact steps for others to reproduce the error** so, this is a problem that has been in blender for a while, but I never saw any reason to report it since probably nobody paints a model while its being animated. the problem works more easily on texture paint mode, tho I think I got it in weight and vertex paint mode in higher poly meshes. [2021-01-08 14-25-54.mp4](https://archive.blender.org/developer/F9555995/2021-01-08_14-25-54.mp4) [bug.blend](https://archive.blender.org/developer/F9555998/bug.blend) [blender_system_info.txt](https://archive.blender.org/developer/F9555996/blender_system_info.txt) [blender_debug_output.txt](https://archive.blender.org/developer/F9555997/blender_debug_output.txt)

Diogo Valadares Reis dos Santos commented

2021-01-08 18:31:20 +01:00

Added subscriber: @Diogo_Valadares

Robert Guetzkow changed title from ~~crash while painting a rigged model while its running an animation~~ to Crash when painting a rigged model while it is playing an animation

2021-01-09 12:07:42 +01:00

Robert Guetzkow commented

2021-01-09 12:07:49 +01:00

Added subscriber: @rjg

Robert Guetzkow commented

2021-01-09 12:07:49 +01:00

Changed status from 'Needs Triage' to: 'Confirmed'

Robert Guetzkow commented

2021-01-09 12:07:49 +01:00

I can confirm this crash. ASAN reports a use-after-free.

## 17387==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000a34598 at pc 0x000008b30f63 bp 0x7ffffffefc70 sp 0x7ffffffefc60
READ of size 4 at 0x604000a34598 thread T0
    - 0 0x8b30f62 in project_paint_face_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:2986
    - 1 0x8b3a527 in project_bucket_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:3495
    - 2 0x8b5b6c9 in do_projectpaint_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5208
    - 3 0x18f7ac54 in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 4 0x18f7c0c7 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:93
    - 5 0x4fabd44 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fabd44)
    - 6 0x18f7b324 in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:160
    - 7 0x18f7afce in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:395
    - 8 0x18f7ad25 in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 9 0x18f7bf67 in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1048
    - 10 0x4fb9444 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fb9444)
    - 11 0x4fb96fa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fb96fa)
    - 12 0x389e101 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:809
    - 13 0x68a31a4 in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    - 14 0x18f787ca in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:250
    - 15 0x18f79d82 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:499
    - 16 0x8b62399 in project_paint_op /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5640
    - 17 0x8b6409b in paint_proj_stroke_ps /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5740
    - 18 0x8b64970 in paint_proj_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5781
    - 19 0x8abfeea in paint_stroke_update_step /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:570
    - 20 0x8b89eb6 in paint_brush_stroke_add_step /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:633
    - 21 0x8b8cc6c in paint_space_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:871
    - 22 0x8b96326 in paint_stroke_modal /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:1507
    - 23 0x4fe8cf6 in wm_handler_operator_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2043
    - 24 0x4ff1dc2 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2838
    - 25 0x4ff207c in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886
    - 26 0x4ff7783 in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3309
    - 27 0x4fc4f8f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    - 28 0x3523a3a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    - 29 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #30 0x3522bed in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x3522bed)

0x604000a34598 is located 8 bytes inside of 40-byte region [0x604000a34590,0x604000a345b8)
freed by thread T0 here:
    - 0 0x7ffff76907cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    - 1 0x18fba180 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    - 2 0x386a248 in BKE_mesh_runtime_clear_geometry /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:232
    - 3 0x3867ad8 in BKE_mesh_runtime_clear_cache /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:87
    - 4 0x380c2fe in mesh_free_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:158
    - 5 0x38183e7 in BKE_mesh_free /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:795
    - 6 0x381ba6f in BKE_mesh_eval_delete /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:987
    - 7 0x39aa6e4 in BKE_object_free_derived_caches /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object.c:1573
    - 8 0x4b05a16 in mesh_build_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:1856
    - 9 0x4b077c7 in makeDerivedMesh /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:2020
    - 10 0x39fa91a in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:193
    - 11 0x39fd6c0 in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:385
    - 12 0x17495261 in void std::__invoke_impl<void, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(std::__invoke_other, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/9/bits/invoke.h:60
    - 13 0x1748d75d in std::__invoke_result<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>::type std::__invoke<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/9/bits/invoke.h:95
    - 14 0x17481760 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::__call<void, Depsgraph*&&, 0ul, 1ul, 2ul>(std::tuple<Depsgraph*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/include/c++/9/functional:400
    - 15 0x17475ea1 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::operator()<Depsgraph*, void>(Depsgraph*&&) /usr/include/c++/9/functional:484
    - 16 0x1746b03b in std::_Function_handler<void (Depsgraph*), std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)> >::_M_invoke(std::_Any_data const&, Depsgraph*&&) /usr/include/c++/9/bits/std_function.h:300
    - 17 0x173def02 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 18 0x173da471 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    - 19 0x173da4c0 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    - 20 0x18f7ac54 in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118
    - 21 0x18f7c0c7 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:93
    - 22 0x4fabd44 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fabd44)
    - 23 0x7fffffffccef  ([stack]+0x1fcef)

previously allocated by thread T0 here:
    - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    - 1 0x18fbabe0 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    - 2 0x18fbaf87 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312
    - 3 0x386823f in mesh_ensure_looptri_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:117
    - 4 0x386847d in BKE_mesh_runtime_looptri_recalc /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:129
    - 5 0x3869100 in BKE_mesh_runtime_looptri_ensure /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:166
    - 6 0x8b48362 in proj_paint_state_mesh_eval_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:4069
    - 7 0x8b4ee4c in project_paint_begin /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:4469
    - 8 0x8b69379 in paint_proj_new_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5973
    - 9 0x8abeff9 in texture_paint_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:504
    - 10 0x8ac11ca in paint_stroke_test_start /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:687
    - 11 0x8b94982 in paint_stroke_modal /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:1435
    - 12 0x8ac145d in paint_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:709
    - 13 0x4fe1725 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1300
    - 14 0x4fe9aec in wm_handler_operator_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2141
    - 15 0x4fed63b in wm_handlers_do_keymap_with_keymap_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2466
    - 16 0x4ff0dee in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2762
    - 17 0x4ff207c in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886
    - 18 0x4ff83f3 in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3382
    - 19 0x4fc4f8f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    - 20 0x3523a3a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    - 21 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:2986 in project_paint_face_init
Shadow bytes around the buggy address:
  0x0c088013e860: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088013e870: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd
  0x0c088013e880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
  0x0c088013e890: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088013e8a0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00
# >0x0c088013e8b0: fa fa fd[fd]fd fd fd fa fa fa 00 00 00 00 00 fa
  0x0c088013e8c0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
  0x0c088013e8d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088013e8e0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088013e8f0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
  0x0c088013e900: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):

Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc

I can confirm this crash. ASAN reports a use-after-free. ```lines ## 17387==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000a34598 at pc 0x000008b30f63 bp 0x7ffffffefc70 sp 0x7ffffffefc60 READ of size 4 at 0x604000a34598 thread T0 - 0 0x8b30f62 in project_paint_face_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:2986 - 1 0x8b3a527 in project_bucket_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:3495 - 2 0x8b5b6c9 in do_projectpaint_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5208 - 3 0x18f7ac54 in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 4 0x18f7c0c7 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:93 - 5 0x4fabd44 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fabd44) - 6 0x18f7b324 in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:160 - 7 0x18f7afce in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:395 - 8 0x18f7ad25 in Task::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 9 0x18f7bf67 in tbb::internal::function_task<Task>::execute() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1048 - 10 0x4fb9444 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fb9444) - 11 0x4fb96fa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fb96fa) - 12 0x389e101 in tbb::task::wait_for_all() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:809 - 13 0x68a31a4 in tbb::internal::task_group_base::wait() /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168 - 14 0x18f787ca in tbb_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:250 - 15 0x18f79d82 in BLI_task_pool_work_and_wait /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:499 - 16 0x8b62399 in project_paint_op /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5640 - 17 0x8b6409b in paint_proj_stroke_ps /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5740 - 18 0x8b64970 in paint_proj_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5781 - 19 0x8abfeea in paint_stroke_update_step /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:570 - 20 0x8b89eb6 in paint_brush_stroke_add_step /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:633 - 21 0x8b8cc6c in paint_space_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:871 - 22 0x8b96326 in paint_stroke_modal /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:1507 - 23 0x4fe8cf6 in wm_handler_operator_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2043 - 24 0x4ff1dc2 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2838 - 25 0x4ff207c in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886 - 26 0x4ff7783 in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3309 - 27 0x4fc4f8f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 - 28 0x3523a3a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522 - 29 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) #30 0x3522bed in _start (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x3522bed) 0x604000a34598 is located 8 bytes inside of 40-byte region [0x604000a34590,0x604000a345b8) freed by thread T0 here: - 0 0x7ffff76907cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) - 1 0x18fba180 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129 - 2 0x386a248 in BKE_mesh_runtime_clear_geometry /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:232 - 3 0x3867ad8 in BKE_mesh_runtime_clear_cache /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:87 - 4 0x380c2fe in mesh_free_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:158 - 5 0x38183e7 in BKE_mesh_free /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:795 - 6 0x381ba6f in BKE_mesh_eval_delete /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh.c:987 - 7 0x39aa6e4 in BKE_object_free_derived_caches /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object.c:1573 - 8 0x4b05a16 in mesh_build_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:1856 - 9 0x4b077c7 in makeDerivedMesh /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:2020 - 10 0x39fa91a in BKE_object_handle_data_update /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:193 - 11 0x39fd6c0 in BKE_object_eval_uber_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/object_update.c:385 - 12 0x17495261 in void std::__invoke_impl<void, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(std::__invoke_other, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/9/bits/invoke.h:60 - 13 0x1748d75d in std::__invoke_result<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>::type std::__invoke<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/9/bits/invoke.h:95 - 14 0x17481760 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::__call<void, Depsgraph*&&, 0ul, 1ul, 2ul>(std::tuple<Depsgraph*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/include/c++/9/functional:400 - 15 0x17475ea1 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::operator()<Depsgraph*, void>(Depsgraph*&&) /usr/include/c++/9/functional:484 - 16 0x1746b03b in std::_Function_handler<void (Depsgraph*), std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)> >::_M_invoke(std::_Any_data const&, Depsgraph*&&) /usr/include/c++/9/bits/std_function.h:300 - 17 0x173def02 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 18 0x173da471 in evaluate_node /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 - 19 0x173da4c0 in deg_task_run_func /home/dev/01-data/01-git/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 - 20 0x18f7ac54 in Task::operator()() const::{lambda()#1}::operator()() const /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:118 - 21 0x18f7c0c7 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /home/dev/01-data/01-git/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:93 - 22 0x4fabd44 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/dev/01-data/01-git/blender-git/build_linux_debug_full/bin/blender+0x4fabd44) - 23 0x7fffffffccef ([stack]+0x1fcef) previously allocated by thread T0 here: - 0 0x7ffff7690bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8) - 1 0x18fbabe0 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276 - 2 0x18fbaf87 in MEM_lockfree_malloc_arrayN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:312 - 3 0x386823f in mesh_ensure_looptri_data /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:117 - 4 0x386847d in BKE_mesh_runtime_looptri_recalc /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:129 - 5 0x3869100 in BKE_mesh_runtime_looptri_ensure /home/dev/01-data/01-git/blender-git/blender/source/blender/blenkernel/intern/mesh_runtime.c:166 - 6 0x8b48362 in proj_paint_state_mesh_eval_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:4069 - 7 0x8b4ee4c in project_paint_begin /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:4469 - 8 0x8b69379 in paint_proj_new_stroke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:5973 - 9 0x8abeff9 in texture_paint_init /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:504 - 10 0x8ac11ca in paint_stroke_test_start /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:687 - 11 0x8b94982 in paint_stroke_modal /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_stroke.c:1435 - 12 0x8ac145d in paint_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image.c:709 - 13 0x4fe1725 in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1300 - 14 0x4fe9aec in wm_handler_operator_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2141 - 15 0x4fed63b in wm_handlers_do_keymap_with_keymap_handler /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2466 - 16 0x4ff0dee in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2762 - 17 0x4ff207c in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2886 - 18 0x4ff83f3 in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3382 - 19 0x4fc4f8f in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635 - 20 0x3523a3a in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522 - 21 0x7ffff6e490b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/sculpt_paint/paint_image_proj.c:2986 in project_paint_face_init Shadow bytes around the buggy address: 0x0c088013e860: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c088013e870: fa fa 00 00 00 00 00 00 fa fa fd fd fd fd fd fd 0x0c088013e880: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa 0x0c088013e890: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c088013e8a0: fa fa fd fd fd fd fd fd fa fa 00 00 00 00 00 00 # >0x0c088013e8b0: fa fa fd[fd]fd fd fd fa fa fa 00 00 00 00 00 fa 0x0c088013e8c0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd 0x0c088013e8d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c088013e8e0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c088013e8f0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c088013e900: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): ``` Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ```

Philipp Oeser commented

2021-01-11 10:13:27 +01:00

Added subscriber: @lichtwerk

Philipp Oeser commented

2021-01-11 10:13:27 +01:00

This has been reported before, see #75045 (Blender Crashing When Painting Stroke into a "Moving Animated Character" (heap-use-after-free)), will merge these reports.

Philipp Oeser commented

2021-01-11 10:13:35 +01:00

Closed as duplicate of #75045

Philipp Oeser closed this issue

2021-01-11 10:13:35 +01:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash when painting a rigged model while it is playing an animation #84532