ASAN: Trying to Undo a knife-project operation causes heap-use-after-free failure #90493

New Issue

Jesse Yurkovich · 2021-08-07T07:34:45+02:00

Jesse Yurkovich commented

2021-08-07 07:34:45 +02:00

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1070 with Max-Q Design/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 462.75

Blender Version
Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-08-07 00:18, hash: b33b70ed07
Worked: (newest version of Blender that worked as expected)

Short description of error
Attempting to undo a knife-project operation between 2 different objects seems to run into a use-after-free error.

Exact steps for others to reproduce the error
knife-project-undo.blend

Load attached file
- Contains a plane above the default cube. The plane is being projected onto the cube from the Top view
Run Mesh->Knife Project
Undo

BMEditMesh *em = (ob->mode & OB_MODE_EDIT) ? ((Mesh *)ob->data)->edit_mesh : NULL;

==4156==ERROR: AddressSanitizer: heap-use-after-free on address 0x1211013509d0 at pc 0x7ff7d4e7ba62 bp 0x0077c9a6bb10 sp 0x0077c9a6bb10
READ of size 8 at 0x1211013509d0 thread T31
    - 0 0x7ff7d4e7ba61 in BKE_object_handle_data_update C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\object_update.c:174
    - 1 0x7ff7d4e7a073 in BKE_object_eval_uber_data C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\object_update.c:395
...

0x1211013509d0 is located 336 bytes inside of 1816-byte region [0x121101350880,0x121101350f98)
freed by thread T0 here:
    - 0 0x7fff2b09d041  (C:\Users\jesse\source\blender-git\build_windows_Full_x64_vc16_Release\bin\Debug\clang_rt.asan_dbg_dynamic-x86_64.dll+0x18004d041)
    - 1 0x7ff7e33554b9 in MEM_lockfree_freeN C:\Users\jesse\source\blender-git\blender\intern\guardedalloc\intern\mallocn_lockfree_impl.c:130
    - 2 0x7ff7d49aa317 in BKE_id_free_ex C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\lib_id_delete.c:193
    - 3 0x7ff7d49aa35e in BKE_id_free C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\lib_id_delete.c:208
    #4 0x7ff7d4a828da in BKE_mesh_eval_geometry C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\mesh.c:2245

Full asan report:
asan-report.txt

**System Information** Operating system: Windows-10-10.0.19041-SP0 64 Bits Graphics card: GeForce GTX 1070 with Max-Q Design/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 462.75 **Blender Version** Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-08-07 00:18, hash: `b33b70ed07` Worked: (newest version of Blender that worked as expected) **Short description of error** Attempting to undo a knife-project operation between 2 different objects seems to run into a use-after-free error. **Exact steps for others to reproduce the error** [knife-project-undo.blend](https://archive.blender.org/developer/F10273121/knife-project-undo.blend) - Load attached file - Contains a plane above the default cube. The plane is being projected onto the cube from the Top view - Run Mesh->Knife Project - Undo ``` BMEditMesh *em = (ob->mode & OB_MODE_EDIT) ? ((Mesh *)ob->data)->edit_mesh : NULL; ==4156==ERROR: AddressSanitizer: heap-use-after-free on address 0x1211013509d0 at pc 0x7ff7d4e7ba62 bp 0x0077c9a6bb10 sp 0x0077c9a6bb10 READ of size 8 at 0x1211013509d0 thread T31 - 0 0x7ff7d4e7ba61 in BKE_object_handle_data_update C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\object_update.c:174 - 1 0x7ff7d4e7a073 in BKE_object_eval_uber_data C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\object_update.c:395 ... 0x1211013509d0 is located 336 bytes inside of 1816-byte region [0x121101350880,0x121101350f98) freed by thread T0 here: - 0 0x7fff2b09d041 (C:\Users\jesse\source\blender-git\build_windows_Full_x64_vc16_Release\bin\Debug\clang_rt.asan_dbg_dynamic-x86_64.dll+0x18004d041) - 1 0x7ff7e33554b9 in MEM_lockfree_freeN C:\Users\jesse\source\blender-git\blender\intern\guardedalloc\intern\mallocn_lockfree_impl.c:130 - 2 0x7ff7d49aa317 in BKE_id_free_ex C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\lib_id_delete.c:193 - 3 0x7ff7d49aa35e in BKE_id_free C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\lib_id_delete.c:208 #4 0x7ff7d4a828da in BKE_mesh_eval_geometry C:\Users\jesse\source\blender-git\blender\source\blender\blenkernel\intern\mesh.c:2245 ``` Full asan report: [asan-report.txt](https://archive.blender.org/developer/F10273123/asan-report.txt)

Jesse Yurkovich commented

2021-08-07 07:34:45 +02:00

Added subscriber: @deadpin