Crash (memory use after free) on freeing RigidBody world #91959

New Issue

Bastien Montagne · 2021-10-05T11:05:12+02:00

Bastien Montagne commented

2021-10-05 11:05:12 +02:00

Reproducible with current master, probably there since forever.

Steps

With an ASAN build:

Open rigid.anim.blend
Close Blender

rigid.anim.blend

(Case found while working on #86379 (When using "Append" rigid body objects + empty constraint, none of its constraints work.))

Reproducible with current master, probably there since forever. # Steps With an ASAN build: - Open `rigid.anim.blend` - Close Blender [rigid.anim.blend](https://archive.blender.org/developer/F10778893/rigid.anim.blend) (Case found while working on #86379 (When using "Append" rigid body objects + empty constraint, none of its constraints work.))

Bastien Montagne commented

2021-10-05 11:05:12 +02:00

Changed status from 'Needs Triage' to: 'Confirmed'

Bastien Montagne commented

2021-10-05 11:05:12 +02:00

Added subscriber: @mont29

Bastien Montagne commented

2021-10-05 11:05:27 +02:00

Preliminary investigations

Seems that order (i.e. names) of RBW operands (objects and constraints) is the issue here, afaiks BKE_rigidbody_free_object does remove the object from the RB world, and RB_body_delete does remove object from constraints references. But BKE_rigidbody_free_constraint/RB_constraint_delete does nothing like that, so it'd seem that when freeing the RBconstraint object first, freeing an RBobject object that uses that RBconstraint object does access freed memory?

=================================================================
==2265557==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b0000c3990 at pc 0x00001af07c6a bp 0x7fff2b9de920 sp 0x7fff2b9de918
READ of size 8 at 0x61b0000c3990 thread T0
    - 0 0x1af07c69 in btRigidBody::removeConstraintRef(btTypedConstraint*) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/Dynamics/btRigidBody.cpp:445
    - 1 0x1a24f7a9 in RB_body_delete /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:371
    - 2 0x10aa74ad in BKE_rigidbody_free_object /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:194
    - 3 0x107c908d in object_free_data /home/guest/blender/src/source/blender/blenkernel/intern/object.c:303
    - 4 0x103b77c5 in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:85
    - 5 0x103b7cc8 in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:161
    - 6 0x10415bba in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:76
    - 7 0xfb531ed in BKE_blender_free /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:82
    - 8 0x119ba293 in WM_exit_ex /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:572
    - 9 0x119ba47f in WM_exit /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:664
    - 10 0x119b97cd in wm_exit_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:428
    - 11 0x1192c88b in wm_handler_ui_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:694
    - 12 0x119447ba in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3045
    - 13 0x11945a39 in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3161
    - 14 0x1194b726 in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3655
    - 15 0x1190b272 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:647
    - 16 0xfb41bb3 in main /home/guest/blender/src/source/creator/creator.c:558
    - 17 0x7f1b16233d09 in __libc_start_main ../csu/libc-start.c:308
    #18 0xfb40dc9 in _start (/home/guest/blender/build_master_debug/bin/blender+0xfb40dc9)

0x61b0000c3990 is located 16 bytes inside of 1535-byte region [0x61b0000c3980,0x61b0000c3f7f)
freed by thread T0 here:
    - 0 0x7f1b263a51f7 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127
    - 1 0x1af0fa1e in btFreeDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:31
    - 2 0x1af0fbcb in btAlignedFreeDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:86
    - 3 0x1af0fca9 in btAlignedFreeInternal(void*) /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:260
    - 4 0x1a285a17 in btHingeConstraint::operator delete(void*) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:98
    - 5 0x1ae09ed5 in btHingeConstraint::~btHingeConstraint() /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:48
    - 6 0x1a25f097 in RB_constraint_delete /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:1138
    - 7 0x10aa7a33 in BKE_rigidbody_free_constraint /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:223
    - 8 0x107c9099 in object_free_data /home/guest/blender/src/source/blender/blenkernel/intern/object.c:304
    - 9 0x103b77c5 in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:85
    - 10 0x103b7cc8 in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:161
    - 11 0x10415bba in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:76
    - 12 0xfb531ed in BKE_blender_free /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:82
    - 13 0x119ba293 in WM_exit_ex /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:572
    - 14 0x119ba47f in WM_exit /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:664
    - 15 0x119b97cd in wm_exit_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:428
    - 16 0x1192c88b in wm_handler_ui_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:694
    - 17 0x119447ba in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3045
    - 18 0x11945a39 in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3161
    - 19 0x1194b726 in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3655
    - 20 0x1190b272 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:647
    - 21 0xfb41bb3 in main /home/guest/blender/src/source/creator/creator.c:558
    #22 0x7f1b16233d09 in __libc_start_main ../csu/libc-start.c:308

previously allocated by thread T0 here:
    - 0 0x7f1b263a54ef in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
    - 1 0x1af0fa04 in btAllocDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:26
    - 2 0x1af0fa74 in btAlignedAllocDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:66
    - 3 0x1af0fc7c in btAlignedAllocInternal(unsigned long, int) /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:247
    - 4 0x1a2859fd in btHingeConstraint::operator new(unsigned long) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:98
    - 5 0x1a25d7b1 in RB_constraint_new_hinge /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:1014
    - 6 0x10ab24c0 in rigidbody_validate_sim_constraint /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:1016
    - 7 0x10abe74f in rigidbody_update_simulation /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:1925
    - 8 0x10ac3280 in BKE_rigidbody_rebuild_world /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:2204
    - 9 0x10ac4a3c in BKE_rigidbody_rebuild_sim /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:2410
    - 10 0x123dc9c8 in operator() /home/guest/blender/src/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1297
    - 11 0x1240eeff in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_rigidbody(Scene*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    - 12 0x1240764c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_rigidbody(Scene*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    - 13 0x12400cdd in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    - 14 0x1252979a in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    - 15 0x12524e76 in evaluate_node /home/guest/blender/src/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    - 16 0x12524ec0 in deg_task_run_func /home/guest/blender/src/source/blender/depsgraph/intern/eval/deg_eval.cc:129
    - 17 0x226cb649 in Task::operator()() const /home/guest/blender/src/source/blender/blenlib/intern/task_pool.cc:178
    - 18 0x226ceb35 in tbb::internal::function_task<Task>::execute() /usr/include/tbb/task.h:1059
    - 19 0x7f1b262de494  (/lib/x86_64-linux-gnu/libtbb.so.2+0x2b494)

SUMMARY: AddressSanitizer: heap-use-after-free /home/guest/blender/src/extern/bullet2/src/BulletDynamics/Dynamics/btRigidBody.cpp:445 in btRigidBody::removeConstraintRef(btTypedConstraint*)
Shadow bytes around the buggy address:
  0x0c36800106e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c36800106f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3680010700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3680010710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c3680010720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c3680010730: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680010740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680010750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680010760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680010770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c3680010780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==2265557==ABORTING

PS: tried this patch, but it does not do the work...

P2482: (An Untitled Masterwork)

diff --git a/source/blender/blenkernel/BKE_rigidbody.h b/source/blender/blenkernel/BKE_rigidbody.h
index ae1e437cd60..137c1aef2ab 100644
--- a/source/blender/blenkernel/BKE_rigidbody.h
+++ b/source/blender/blenkernel/BKE_rigidbody.h
@@ -43,7 +43,7 @@ struct Scene;
 
 void BKE_rigidbody_free_world(struct Scene *scene);
 void BKE_rigidbody_free_object(struct Object *ob, struct RigidBodyWorld *rbw);
-void BKE_rigidbody_free_constraint(struct Object *ob);
+void BKE_rigidbody_free_constraint(struct Object *ob, struct RigidBodyWorld *rbw);
 
 /* ...... */
 
diff --git a/source/blender/blenkernel/intern/object.c b/source/blender/blenkernel/intern/object.c
index ec39c5b45c4..bd593259092 100644
--- a/source/blender/blenkernel/intern/object.c
+++ b/source/blender/blenkernel/intern/object.c
@@ -301,7 +301,7 @@ static void object_free_data(ID *id)
 
   BKE_partdeflect_free(ob->pd);
   BKE_rigidbody_free_object(ob, NULL);
-  BKE_rigidbody_free_constraint(ob);
+  BKE_rigidbody_free_constraint(ob, NULL);
 
   sbFree(ob);
 
diff --git a/source/blender/blenkernel/intern/rigidbody.c b/source/blender/blenkernel/intern/rigidbody.c
index 242bad163d8..065f0b41ba5 100644
--- a/source/blender/blenkernel/intern/rigidbody.c
+++ b/source/blender/blenkernel/intern/rigidbody.c
@@ -181,7 +181,7 @@ void BKE_rigidbody_free_object(Object *ob, RigidBodyWorld *rbw)
         RB_dworld_remove_body(rbw->shared->physics_world, rbo->shared->physics_object);
       }
       else {
-        /* We have no access to 'owner' RBW when deleting the object ID itself... No choice bu to
+        /* We have no access to 'owner' RBW when deleting the object ID itself. No choice but to
          * loop over all scenes then. */
         for (Scene *scene = G_MAIN->scenes.first; scene != NULL; scene = scene->id.next) {
           RigidBodyWorld *scene_rbw = scene->rigidbody_world;
@@ -209,7 +209,7 @@ void BKE_rigidbody_free_object(Object *ob, RigidBodyWorld *rbw)
 }
 
 /* Free RigidBody constraint and sim instance */
-void BKE_rigidbody_free_constraint(Object *ob)
+void BKE_rigidbody_free_constraint(Object *ob, RigidBodyWorld *rbw)
 {
   RigidBodyCon *rbc = (ob) ? ob->rigidbody_constraint : NULL;
 
@@ -220,6 +220,23 @@ void BKE_rigidbody_free_constraint(Object *ob)
 
   /* free physics reference */
   if (rbc->physics_constraint) {
+    if (rbw != NULL && rbw->shared->physics_world != NULL) {
+      /* We can only remove the constraint from the world if the world is known.
+       * The world is generally only unknown if it's an evaluated copy of
+       * an object that's being freed, in which case this code isn't run anyway. */
+      RB_dworld_remove_constraint(rbw->shared->physics_world, rbc->physics_constraint);
+    }
+    else {
+      /* We have no access to 'owner' RBW when deleting the object ID itself. No choice but to
+       * loop over all scenes then. */
+      for (Scene *scene = G_MAIN->scenes.first; scene != NULL; scene = scene->id.next) {
+        RigidBodyWorld *scene_rbw = scene->rigidbody_world;
+        if (scene_rbw != NULL && scene_rbw->shared->physics_world != NULL) {
+          RB_dworld_remove_constraint(scene_rbw->shared->physics_world, rbc->physics_constraint);
+        }
+      }
+    }
+
     RB_constraint_delete(rbc->physics_constraint);
     rbc->physics_constraint = NULL;
   }
@@ -1629,7 +1646,7 @@ void BKE_rigidbody_remove_constraint(Main *bmain, Scene *scene, Object *ob, cons
   }
 
   /* remove object's settings */
-  BKE_rigidbody_free_constraint(ob);
+  BKE_rigidbody_free_constraint(ob, rbw);
 
   /* flag cache as outdated */
   BKE_rigidbody_cache_reset(rbw);

# Preliminary investigations Seems that order (i.e. names) of RBW operands (objects and constraints) is the issue here, afaiks `BKE_rigidbody_free_object` does remove the object from the RB world, and `RB_body_delete` does remove object from constraints references. But `BKE_rigidbody_free_constraint`/`RB_constraint_delete` does nothing like that, so it'd seem that when freeing the RBconstraint object first, freeing an RBobject object that uses that RBconstraint object does access freed memory? ```lines=10 ================================================================= ==2265557==ERROR: AddressSanitizer: heap-use-after-free on address 0x61b0000c3990 at pc 0x00001af07c6a bp 0x7fff2b9de920 sp 0x7fff2b9de918 READ of size 8 at 0x61b0000c3990 thread T0 - 0 0x1af07c69 in btRigidBody::removeConstraintRef(btTypedConstraint*) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/Dynamics/btRigidBody.cpp:445 - 1 0x1a24f7a9 in RB_body_delete /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:371 - 2 0x10aa74ad in BKE_rigidbody_free_object /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:194 - 3 0x107c908d in object_free_data /home/guest/blender/src/source/blender/blenkernel/intern/object.c:303 - 4 0x103b77c5 in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:85 - 5 0x103b7cc8 in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:161 - 6 0x10415bba in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:76 - 7 0xfb531ed in BKE_blender_free /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:82 - 8 0x119ba293 in WM_exit_ex /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:572 - 9 0x119ba47f in WM_exit /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:664 - 10 0x119b97cd in wm_exit_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:428 - 11 0x1192c88b in wm_handler_ui_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:694 - 12 0x119447ba in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3045 - 13 0x11945a39 in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3161 - 14 0x1194b726 in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3655 - 15 0x1190b272 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:647 - 16 0xfb41bb3 in main /home/guest/blender/src/source/creator/creator.c:558 - 17 0x7f1b16233d09 in __libc_start_main ../csu/libc-start.c:308 #18 0xfb40dc9 in _start (/home/guest/blender/build_master_debug/bin/blender+0xfb40dc9) 0x61b0000c3990 is located 16 bytes inside of 1535-byte region [0x61b0000c3980,0x61b0000c3f7f) freed by thread T0 here: - 0 0x7f1b263a51f7 in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:127 - 1 0x1af0fa1e in btFreeDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:31 - 2 0x1af0fbcb in btAlignedFreeDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:86 - 3 0x1af0fca9 in btAlignedFreeInternal(void*) /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:260 - 4 0x1a285a17 in btHingeConstraint::operator delete(void*) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:98 - 5 0x1ae09ed5 in btHingeConstraint::~btHingeConstraint() /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:48 - 6 0x1a25f097 in RB_constraint_delete /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:1138 - 7 0x10aa7a33 in BKE_rigidbody_free_constraint /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:223 - 8 0x107c9099 in object_free_data /home/guest/blender/src/source/blender/blenkernel/intern/object.c:304 - 9 0x103b77c5 in BKE_libblock_free_datablock /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:85 - 10 0x103b7cc8 in BKE_id_free_ex /home/guest/blender/src/source/blender/blenkernel/intern/lib_id_delete.c:161 - 11 0x10415bba in BKE_main_free /home/guest/blender/src/source/blender/blenkernel/intern/main.c:76 - 12 0xfb531ed in BKE_blender_free /home/guest/blender/src/source/blender/blenkernel/intern/blender.c:82 - 13 0x119ba293 in WM_exit_ex /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:572 - 14 0x119ba47f in WM_exit /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:664 - 15 0x119b97cd in wm_exit_handler /home/guest/blender/src/source/blender/windowmanager/intern/wm_init_exit.c:428 - 16 0x1192c88b in wm_handler_ui_call /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:694 - 17 0x119447ba in wm_handlers_do_intern /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3045 - 18 0x11945a39 in wm_handlers_do /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3161 - 19 0x1194b726 in wm_event_do_handlers /home/guest/blender/src/source/blender/windowmanager/intern/wm_event_system.c:3655 - 20 0x1190b272 in WM_main /home/guest/blender/src/source/blender/windowmanager/intern/wm.c:647 - 21 0xfb41bb3 in main /home/guest/blender/src/source/creator/creator.c:558 #22 0x7f1b16233d09 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: - 0 0x7f1b263a54ef in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145 - 1 0x1af0fa04 in btAllocDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:26 - 2 0x1af0fa74 in btAlignedAllocDefault /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:66 - 3 0x1af0fc7c in btAlignedAllocInternal(unsigned long, int) /home/guest/blender/src/extern/bullet2/src/LinearMath/btAlignedAllocator.cpp:247 - 4 0x1a2859fd in btHingeConstraint::operator new(unsigned long) /home/guest/blender/src/extern/bullet2/src/BulletDynamics/ConstraintSolver/btHingeConstraint.h:98 - 5 0x1a25d7b1 in RB_constraint_new_hinge /home/guest/blender/src/intern/rigidbody/rb_bullet_api.cpp:1014 - 6 0x10ab24c0 in rigidbody_validate_sim_constraint /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:1016 - 7 0x10abe74f in rigidbody_update_simulation /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:1925 - 8 0x10ac3280 in BKE_rigidbody_rebuild_world /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:2204 - 9 0x10ac4a3c in BKE_rigidbody_rebuild_sim /home/guest/blender/src/source/blender/blenkernel/intern/rigidbody.c:2410 - 10 0x123dc9c8 in operator() /home/guest/blender/src/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1297 - 11 0x1240eeff in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_rigidbody(Scene*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60 - 12 0x1240764c in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_rigidbody(Scene*)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110 - 13 0x12400cdd in _M_invoke /usr/include/c++/10/bits/std_function.h:291 - 14 0x1252979a in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622 - 15 0x12524e76 in evaluate_node /home/guest/blender/src/source/blender/depsgraph/intern/eval/deg_eval.cc:118 - 16 0x12524ec0 in deg_task_run_func /home/guest/blender/src/source/blender/depsgraph/intern/eval/deg_eval.cc:129 - 17 0x226cb649 in Task::operator()() const /home/guest/blender/src/source/blender/blenlib/intern/task_pool.cc:178 - 18 0x226ceb35 in tbb::internal::function_task<Task>::execute() /usr/include/tbb/task.h:1059 - 19 0x7f1b262de494 (/lib/x86_64-linux-gnu/libtbb.so.2+0x2b494) SUMMARY: AddressSanitizer: heap-use-after-free /home/guest/blender/src/extern/bullet2/src/BulletDynamics/Dynamics/btRigidBody.cpp:445 in btRigidBody::removeConstraintRef(btTypedConstraint*) Shadow bytes around the buggy address: 0x0c36800106e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c36800106f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3680010700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3680010710: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c3680010720: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c3680010730: fd fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680010740: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680010750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680010760: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680010770: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c3680010780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==2265557==ABORTING ``` PS: tried this patch, but it does not do the work... [P2482: (An Untitled Masterwork)](https://archive.blender.org/developer/P2482.txt) ``` diff --git a/source/blender/blenkernel/BKE_rigidbody.h b/source/blender/blenkernel/BKE_rigidbody.h index ae1e437cd60..137c1aef2ab 100644 --- a/source/blender/blenkernel/BKE_rigidbody.h +++ b/source/blender/blenkernel/BKE_rigidbody.h @@ -43,7 +43,7 @@ struct Scene; void BKE_rigidbody_free_world(struct Scene *scene); void BKE_rigidbody_free_object(struct Object *ob, struct RigidBodyWorld *rbw); -void BKE_rigidbody_free_constraint(struct Object *ob); +void BKE_rigidbody_free_constraint(struct Object *ob, struct RigidBodyWorld *rbw); /* ...... */ diff --git a/source/blender/blenkernel/intern/object.c b/source/blender/blenkernel/intern/object.c index ec39c5b45c4..bd593259092 100644 --- a/source/blender/blenkernel/intern/object.c +++ b/source/blender/blenkernel/intern/object.c @@ -301,7 +301,7 @@ static void object_free_data(ID *id) BKE_partdeflect_free(ob->pd); BKE_rigidbody_free_object(ob, NULL); - BKE_rigidbody_free_constraint(ob); + BKE_rigidbody_free_constraint(ob, NULL); sbFree(ob); diff --git a/source/blender/blenkernel/intern/rigidbody.c b/source/blender/blenkernel/intern/rigidbody.c index 242bad163d8..065f0b41ba5 100644 --- a/source/blender/blenkernel/intern/rigidbody.c +++ b/source/blender/blenkernel/intern/rigidbody.c @@ -181,7 +181,7 @@ void BKE_rigidbody_free_object(Object *ob, RigidBodyWorld *rbw) RB_dworld_remove_body(rbw->shared->physics_world, rbo->shared->physics_object); } else { - /* We have no access to 'owner' RBW when deleting the object ID itself... No choice bu to + /* We have no access to 'owner' RBW when deleting the object ID itself. No choice but to * loop over all scenes then. */ for (Scene *scene = G_MAIN->scenes.first; scene != NULL; scene = scene->id.next) { RigidBodyWorld *scene_rbw = scene->rigidbody_world; @@ -209,7 +209,7 @@ void BKE_rigidbody_free_object(Object *ob, RigidBodyWorld *rbw) } /* Free RigidBody constraint and sim instance */ -void BKE_rigidbody_free_constraint(Object *ob) +void BKE_rigidbody_free_constraint(Object *ob, RigidBodyWorld *rbw) { RigidBodyCon *rbc = (ob) ? ob->rigidbody_constraint : NULL; @@ -220,6 +220,23 @@ void BKE_rigidbody_free_constraint(Object *ob) /* free physics reference */ if (rbc->physics_constraint) { + if (rbw != NULL && rbw->shared->physics_world != NULL) { + /* We can only remove the constraint from the world if the world is known. + * The world is generally only unknown if it's an evaluated copy of + * an object that's being freed, in which case this code isn't run anyway. */ + RB_dworld_remove_constraint(rbw->shared->physics_world, rbc->physics_constraint); + } + else { + /* We have no access to 'owner' RBW when deleting the object ID itself. No choice but to + * loop over all scenes then. */ + for (Scene *scene = G_MAIN->scenes.first; scene != NULL; scene = scene->id.next) { + RigidBodyWorld *scene_rbw = scene->rigidbody_world; + if (scene_rbw != NULL && scene_rbw->shared->physics_world != NULL) { + RB_dworld_remove_constraint(scene_rbw->shared->physics_world, rbc->physics_constraint); + } + } + } + RB_constraint_delete(rbc->physics_constraint); rbc->physics_constraint = NULL; } @@ -1629,7 +1646,7 @@ void BKE_rigidbody_remove_constraint(Main *bmain, Scene *scene, Object *ob, cons } /* remove object's settings */ - BKE_rigidbody_free_constraint(ob); + BKE_rigidbody_free_constraint(ob, rbw); /* flag cache as outdated */ BKE_rigidbody_cache_reset(rbw); ```

Soumya Pochiraju commented

2022-01-17 04:17:24 +01:00

Added subscriber: @Forest1

Soumya Pochiraju commented

2022-01-17 04:17:24 +01:00

Not sure if this helps but I single stepped through the function and I think RB_world_remove_constraint in the patch is never called because the rigidbody world has already been freed before this function is called. And the constraints are not removed when the rigidbody world is freed (in source/blender/blenkernel/intern/rigidbody.c- BKE_rigidbody_free_world()) because rbw->constraints is set to null at
source/blender/blenkernel/intern/scene.c line 399, but I couldn't understand why that is necessary

Not sure if this helps but I single stepped through the function and I think RB_world_remove_constraint in the patch is never called because the rigidbody world has already been freed before this function is called. And the constraints are not removed when the rigidbody world is freed (in source/blender/blenkernel/intern/rigidbody.c- BKE_rigidbody_free_world()) because rbw->constraints is set to null at source/blender/blenkernel/intern/scene.c line 399, but I couldn't understand why that is necessary

Philipp Oeser removed the

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Crash (memory use after free) on freeing RigidBody world #91959

Steps

Preliminary investigations