Crashing during animation with Geometry Nodes ( when clicked on Attribute Randomize - Attribute field ) #89313

Blender Version
Broken: version: 2.93, 3.0.0 Alpha, branch: master, commit date: 2021-06-18 21:33, hash: f9aea19d98

Short description of error
Crashing during animation when using Geometry Nodes - when clicked on Attribute Randomize - Attribute field

Exact steps for others to reproduce the error
Open the file, start animation and click on the attribute search button:
scale.blend

OR:

Creating simple scene with an animation of rotating brush :

I added cylinder ( "Cylinder" ) with some loops cuts, assigned these loop cuts' vertices into vertex group ( "Group" ). Added one plane ( "Plane" ) with narrow size. Then Using Geometry Nodes on the "Cylinder" object with Point Instance ( Object = "Plane" ) + Point Distribute ( Density = "Group" ). Then I create keyframe on 0, then keyframe on 50 with cylinder rotation 180 deg, then keyframe on 100 with another rotation 180.
Then I start the animation and all works fine
Then I added Attribute Randomize into the Geometry Nodes for that Cylinder
When animation is stopped, all ok. But when animation is running and I click into Attribute Randomize -> Attribute field, it crashes ( tried 4 times )

**Blender Version** Broken: version: 2.93, 3.0.0 Alpha, branch: master, commit date: 2021-06-18 21:33, hash: `f9aea19d98` **Short description of error** Crashing during animation when using Geometry Nodes - when clicked on Attribute Randomize - Attribute field **Exact steps for others to reproduce the error** Open the file, start animation and click on the attribute search button: [scale.blend](https://archive.blender.org/developer/F10186580/scale.blend) OR: Creating simple scene with an animation of rotating brush : - I added cylinder ( "Cylinder" ) with some loops cuts, assigned these loop cuts' vertices into vertex group ( "Group" ). Added one plane ( "Plane" ) with narrow size. Then Using Geometry Nodes on the "Cylinder" object with Point Instance ( Object = "Plane" ) + Point Distribute ( Density = "Group" ). Then I create keyframe on 0, then keyframe on 50 with cylinder rotation 180 deg, then keyframe on 100 with another rotation 180. - Then I start the animation and all works fine - Then I added Attribute Randomize into the Geometry Nodes for that Cylinder - When animation is stopped, all ok. But when animation is running and I click into Attribute Randomize -> Attribute field, it crashes ( tried 4 times )

Added subscriber: @PetrSmrtka

Added subscriber: @PratikPB2123

Thanks for the report. Can you please provide a simple .blend file?

Changed status from 'Needs Triage' to: 'Needs User Info'

Added subscriber: @dfelinto

I can reproduce this with 2.93 and master. It crashes as soon as I go in the attribute search.

scale.blend

I can reproduce this with 2.93 and master. It crashes as soon as I go in the attribute search. [scale.blend](https://archive.blender.org/developer/F10186580/scale.blend)

Changed status from 'Needs User Info' to: 'Confirmed'

For the records this is the bracktrace (for the main thread): P2191

For the records this is the bracktrace (for the main thread): [P2191](https://archive.blender.org/developer/P2191.txt)

Added subscribers: @JulianEisel, @HooglyBoogly

Interesting. It's use-after-free of the attribute hints. I think this is the cause:

The attribute search button is created and given pointers to the evaluated geometry set.
Animation starts, and the modifier re-evaluates, freeing the evaluated geometry set to replace it with the one for the next frame.
The node editor (and most of the UI) is not redrawn to improve animation playback performance, meaning the button points to a freed geometry set.
You click the search, button-- crash.

The most straightforward solution is probably to disable attribute search when animation is playing, but this must be a relatively common problem in the UI.
@JulianEisel, is disabling the search generally the right approach?

Interesting. It's use-after-free of the attribute hints. I think this is the cause: - The attribute search button is created and given pointers to the evaluated geometry set. - Animation starts, and the modifier re-evaluates, freeing the evaluated geometry set to replace it with the one for the next frame. - The node editor (and most of the UI) is not redrawn to improve animation playback performance, meaning the button points to a freed geometry set. - You click the search, button-- crash. The most straightforward solution is probably to disable attribute search when animation is playing, but this must be a relatively common problem in the UI. @JulianEisel, is disabling the search generally the right approach?

I don't think it makes sense to disable attribute search. Although it seems harmless to do so now, it will be a problem when we have the physics clock detached from the animation clock.

Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set.

Added subscriber: @JacquesLucke

Just wanted to mention that tooltips are disabled as well when the animation is playing, not sure if the reasons are similar.

Given the conversation above I don't know the best solution. Now that the node UI storage is stored on the modifier, at least attribute search works now, but it still crashes when you apply an attribute, because the underlying problem is the same-- AttributeSearchData has a pointer to an old node tree because the the UI isn't redrawn during animation.

Given the conversation above I don't know the best solution. Now that the node UI storage is stored on the modifier, at least attribute search works now, but it still crashes when you apply an attribute, because the underlying problem is the same-- `AttributeSearchData` has a pointer to an old node tree because the the UI isn't redrawn during animation.

AttributeSearchData has a pointer to an old node tree because the the UI isn't redrawn during animation.

Not quite true. The pointer to the tree is fine (it's original dna data), the pointer to the GeometryAttributeInfo is outdated after the modifier ran again.

Here is an alternative solution that does not quite work yet, but could work if we do a refactor in the ui code: P2277.
The idea is, instead of referencing GeometryAttributeInfo, we just copy it into the "state" of the search uibut. This way we can't get a dangling pointer.
The reason this does not work yet, is because the free function passed to UI_but_func_search_set does not work as intended yet. We should just get rid of all those argN stuff, and just always have arg and arg_free. This would give us much more flexibility with what we can put into a uiBut. Not sure how much of a refactor that would be.

> `AttributeSearchData` has a pointer to an old node tree because the the UI isn't redrawn during animation. Not quite true. The pointer to the tree is fine (it's original dna data), the pointer to the `GeometryAttributeInfo` is outdated after the modifier ran again. Here is an alternative solution that does not quite work yet, but could work if we do a refactor in the ui code: [P2277](https://archive.blender.org/developer/P2277.txt). The idea is, instead of referencing `GeometryAttributeInfo`, we just copy it into the "state" of the search uibut. This way we can't get a dangling pointer. The reason this does not work yet, is because the free function passed to `UI_but_func_search_set` does not work as intended yet. We should just get rid of all those `argN` stuff, and just always have `arg` and `arg_free`. This would give us much more flexibility with what we can put into a `uiBut`. Not sure how much of a refactor that would be.

I think some of what Jacques is mentioning might make sense, and issue is still really ugly from a code architecture perspective, since this node isn't exposed anymore I don't think this needs high priority.

Well, after testing, this problem still applies in the modifier.

In #89313#1184414, @JulianEisel wrote:
Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set.

Still wondering why this is not an option. A pointer to the pointer should be fine if it's only the pointed to memory that is recreated.

> In #89313#1184414, @JulianEisel wrote: > Can't there just be a level of indirection, so the evaluated geometry set pointer isn't used directly? E.g. either the button gets a pointer to the pointer (so the latter can change without issues) or it gets the pointer to the owner (or the owning ID even) of the geometry set. Still wondering why this is not an option. A pointer to the pointer should be fine if it's only the pointed to memory that is recreated.

I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it.

Assigning to Hans since he said he will look into it.

In #89313#1246073, @HooglyBoogly wrote:
I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it.

Don't think the original ID would be recreated then. But it may be on undo (esp. if the undone change was to the ID in question).

> In #89313#1246073, @HooglyBoogly wrote: > I suppose that would work if the original ID was not reallocated during animation playback. I assumed that wouldn't be true, but maybe it is? I can look into it. Don't think the original ID would be recreated then. But it may be on undo (esp. if the undone change was to the ID in question).

Okay, maybe that will work then. We'll see if undo is still an issue.

I looked into this yesterday, ended up getting frustrated battling some warnings:

  const void *const *log_v = &nmd.runtime_eval_log;
  const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);

/home/hans/Blender-Git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1182:44: error: invalid ‘static_cast’ from type ‘const void* const*’ to type ‘const blender::nodes::geometry_nodes_eval_log::ModifierLog* const*’
 1182 |   const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);
      |                                            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

diff --git a/source/blender/modifiers/intern/MOD_nodes.cc b/source/blender/modifiers/intern/MOD_nodes.cc
index f87ff844acf..5e741708a03 100644
--- a/source/blender/modifiers/intern/MOD_nodes.cc
+++ b/source/blender/modifiers/intern/MOD_nodes.cc
@@ -1122,7 +1122,7 @@ static void modifyGeometrySet(ModifierData *md,
 }
 
 struct AttributeSearchData {
-  const geo_log::ModifierLog &modifier_log;
+  const geo_log::ModifierLog *const *modifier_log;
   IDProperty &name_property;
   bool is_output;
 };
@@ -1138,9 +1138,9 @@ static void attribute_search_update_fn(const bContext *UNUSED(C),
 {
   AttributeSearchData *data = static_cast<AttributeSearchData *>(arg);
 
-  const geo_log::GeometryValueLog *geometry_log = data->is_output ?
-                                                      data->modifier_log.output_geometry_log() :
-                                                      data->modifier_log.input_geometry_log();
+  const geo_log::GeometryValueLog *geometry_log =
+      data->is_output ? (*data->modifier_log)->output_geometry_log() :
+                        (*data->modifier_log)->input_geometry_log();
   if (geometry_log == nullptr) {
     return;
   }
@@ -1178,7 +1178,8 @@ static void add_attribute_search_button(uiLayout *layout,
                                         const bNodeSocket &socket,
                                         const bool is_output)
 {
-  const geo_log::ModifierLog *log = static_cast<geo_log::ModifierLog *>(nmd.runtime_eval_log);
+  const void *const *log_v = &nmd.runtime_eval_log;
+  const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v);
   if (log == nullptr) {
     uiItemR(layout, md_ptr, rna_path_attribute_name.c_str(), 0, "", ICON_NONE);
     return;
@@ -1211,8 +1212,7 @@ static void add_attribute_search_button(uiLayout *layout,
     return;
   }
 
-  AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData,
-                                                 {*log, *property, is_output});
+  AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, {log, *property, is_output});
 
   UI_but_func_search_set_results_are_suggestions(but, true);
   UI_but_func_search_set_sep_string(but, UI_MENU_ARROW_SEP);

I'll look into it again tomorrow.

Okay, maybe that will work then. We'll see if undo is still an issue. I looked into this yesterday, ended up getting frustrated battling some warnings: ``` const void *const *log_v = &nmd.runtime_eval_log; const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); ``` ``` /home/hans/Blender-Git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1182:44: error: invalid ‘static_cast’ from type ‘const void* const*’ to type ‘const blender::nodes::geometry_nodes_eval_log::ModifierLog* const*’ 1182 | const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ``` ```lines=10 diff --git a/source/blender/modifiers/intern/MOD_nodes.cc b/source/blender/modifiers/intern/MOD_nodes.cc index f87ff844acf..5e741708a03 100644 --- a/source/blender/modifiers/intern/MOD_nodes.cc +++ b/source/blender/modifiers/intern/MOD_nodes.cc @@ -1122,7 +1122,7 @@ static void modifyGeometrySet(ModifierData *md, } struct AttributeSearchData { - const geo_log::ModifierLog &modifier_log; + const geo_log::ModifierLog *const *modifier_log; IDProperty &name_property; bool is_output; }; @@ -1138,9 +1138,9 @@ static void attribute_search_update_fn(const bContext *UNUSED(C), { AttributeSearchData *data = static_cast<AttributeSearchData *>(arg); - const geo_log::GeometryValueLog *geometry_log = data->is_output ? - data->modifier_log.output_geometry_log() : - data->modifier_log.input_geometry_log(); + const geo_log::GeometryValueLog *geometry_log = + data->is_output ? (*data->modifier_log)->output_geometry_log() : + (*data->modifier_log)->input_geometry_log(); if (geometry_log == nullptr) { return; } @@ -1178,7 +1178,8 @@ static void add_attribute_search_button(uiLayout *layout, const bNodeSocket &socket, const bool is_output) { - const geo_log::ModifierLog *log = static_cast<geo_log::ModifierLog *>(nmd.runtime_eval_log); + const void *const *log_v = &nmd.runtime_eval_log; + const geo_log::ModifierLog *const *log = static_cast<const geo_log::ModifierLog *const *>(log_v); if (log == nullptr) { uiItemR(layout, md_ptr, rna_path_attribute_name.c_str(), 0, "", ICON_NONE); return; @@ -1211,8 +1212,7 @@ static void add_attribute_search_button(uiLayout *layout, return; } - AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, - {*log, *property, is_output}); + AttributeSearchData *data = OBJECT_GUARDED_NEW(AttributeSearchData, {log, *property, is_output}); UI_but_func_search_set_results_are_suggestions(but, true); UI_but_func_search_set_sep_string(but, UI_MENU_ARROW_SEP); ``` I'll look into it again tomorrow.

This issue was referenced by 22ffd69a91

This issue was referenced by 22ffd69a91c9287e4f61e620ec2beaf9b1ff22c1

Changed status from 'Confirmed' to: 'Resolved'

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Labels Milestones

Crashing during animation with Geometry Nodes ( when clicked on Attribute Randomize - Attribute field ) #89313