Crash when playing animation in eevee rendered view #94797

New Issue

Wouter Stomp · 2022-01-10T17:38:08+01:00

Wouter Stomp commented

2022-01-10 17:38:08 +01:00

System Information
Operating system: macOS-12.1-arm64-arm-64bit 64 Bits
Graphics card: Apple M1 Max Apple 4.1 Metal - 76.3

Blender Version
Broken: version: 3.1.0 Alpha, branch: master, commit date: 2022-01-07 23:28, hash: 741ed5fcd2
Worked: unknown

Short description of error
The attached file will crash blender when played in eevee rendered view. Most often within seconds, sometimes after a little while longer up to about a minute.

Exact steps for others to reproduce the error
open attached file
switch to rendered view
press space to start animation

Birdie.blend
Crash eevee animation.txt

**System Information** Operating system: macOS-12.1-arm64-arm-64bit 64 Bits Graphics card: Apple M1 Max Apple 4.1 Metal - 76.3 **Blender Version** Broken: version: 3.1.0 Alpha, branch: master, commit date: 2022-01-07 23:28, hash: `741ed5fcd2` Worked: unknown **Short description of error** The attached file will crash blender when played in eevee rendered view. Most often within seconds, sometimes after a little while longer up to about a minute. **Exact steps for others to reproduce the error** open attached file switch to rendered view press space to start animation [Birdie.blend](https://archive.blender.org/developer/F12799378/Birdie.blend) [Crash eevee animation.txt](https://archive.blender.org/developer/F12799375/Crash_eevee_animation.txt)

Wouter Stomp commented

2022-01-10 17:38:08 +01:00

Added subscriber: @blenderrocket

Michael commented

2022-01-10 20:17:32 +01:00

Added subscriber: @michael64

Michael commented

2022-01-10 20:17:32 +01:00

In can confirm this as a reproducible crash for Apple M1 and also Windows 10 debug builds.
On both systems the animation crashes on a worker thread at the same location:

image_walk_gpu_materials image.c:3409
image_walk_id_all_users image.c:3435
BKE_image_user_id_eval_animation image.c:5808
$_10::operator()(Depsgraph *) const deg_builder_nodes.cc:1142
decltype(std::__1::forward<blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&>(fp)(std::__1::forward<Depsgraph*>(fp0))) std::__1::__invoke<blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&, Depsgraph*>(blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&, Depsgraph*&&) type_traits:3694

In can confirm this as a reproducible crash for Apple M1 and also Windows 10 debug builds. On both systems the animation crashes on a worker thread at the same location: ``` image_walk_gpu_materials image.c:3409 image_walk_id_all_users image.c:3435 BKE_image_user_id_eval_animation image.c:5808 $_10::operator()(Depsgraph *) const deg_builder_nodes.cc:1142 decltype(std::__1::forward<blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&>(fp)(std::__1::forward<Depsgraph*>(fp0))) std::__1::__invoke<blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&, Depsgraph*>(blender::deg::DepsgraphNodeBuilder::build_animation_images(ID*)::$_10&, Depsgraph*&&) type_traits:3694 ```

Michael commented

2022-01-10 20:31:09 +01:00

Added subscriber: @JacquesLucke

Michael commented

2022-01-10 20:31:09 +01:00

I just tested d09b1d2759 which crashes within 20 seconds or less and its parent 56344fb30f which does not crash.
As the exact line of the crash was added in d09b1d2759 I am paging @JacquesLucke.

I just tested d09b1d2759 which crashes within 20 seconds or less and its parent 56344fb30f which does not crash. As the exact line of the crash was added in d09b1d2759 I am paging @JacquesLucke.

Pratik Borhade commented

2022-01-11 11:57:49 +01:00

Added subscriber: @PratikPB2123

Pratik Borhade commented

2022-01-11 11:57:49 +01:00

@michael64 , thanks again for investigating. But no crash here on both daily and debug build (f134341e03)
Have you checked on current master or recent daily build?

@JacquesLucke , are you able to reproduce the crash?

Operating system : Windows-10-10.0.18362-SP0 64 Bits
Graphics card : AMD Radeon(TM) 535 ATI Technologies .```

@michael64 , thanks again for investigating. But no crash here on both daily and debug build (f134341e03b5fe3edd5112557bcf42f6667ba69d) Have you checked on current master or recent daily build? @JacquesLucke , are you able to reproduce the crash? ```System Information Operating system : Windows-10-10.0.18362-SP0 64 Bits Graphics card : AMD Radeon(TM) 535 ATI Technologies .```

Jacques Lucke commented

2022-01-11 11:59:29 +01:00

I tried yesterday, but couldn't reproduce it yet.

Michael commented

2022-01-11 12:57:41 +01:00

@PratikPB2123, for this issue I have not seen any release build on Windows crash so far.
On Windows a debug build of f134341e03 with -DCMAKE_BUILD_TYPE_INIT:STRING=Debug mostly crashes within 20 seconds but I saw a debug build run that ran for minutes without crashing and I stopped it.
This is the compiler version I am using on Windows:

Microsoft (R) C/C++ Optimizing Compiler Version 19.29.30138 for x64

On macOS even the downloaded Blender 3.1.0 Alpha 922ae55a16 Apple Silicon crashes within in a second.

@PratikPB2123, for this issue I have not seen any release build on Windows crash so far. On Windows a debug build of f134341e03b with -DCMAKE_BUILD_TYPE_INIT:STRING=Debug mostly crashes within 20 seconds but I saw a debug build run that ran for minutes without crashing and I stopped it. This is the compiler version I am using on Windows: ``` Microsoft (R) C/C++ Optimizing Compiler Version 19.29.30138 for x64 ``` On macOS even the downloaded Blender 3.1.0 Alpha 922ae55a16a9 Apple Silicon crashes within in a second.

Ankit Meel commented

2022-01-11 14:06:56 +01:00

Added subscriber: @ankitm

Ankit Meel commented

2022-01-11 14:06:56 +01:00

~~blender-3.1.0-alpha+master.37d6ae16be2b-darwin.x86_64-release.dmg doesn't crash ~~

~~`blender-3.1.0-alpha+master.37d6ae16be2b-darwin.x86_64-release.dmg` doesn't crash ~~

Ankit Meel commented

2022-01-11 14:10:42 +01:00

Spoke too soon T94797_crash.txt

Spoke too soon [T94797_crash.txt](https://archive.blender.org/developer/F12800883/T94797_crash.txt)

Jacques Lucke commented

2022-01-11 15:38:09 +01:00

Can you reproduce it with ASAN?

Michael commented

2022-01-11 15:48:56 +01:00

I can offer a little ASAN crash on Linux:

/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender
ndof: spacenavd not found
Read prefs: /home/dev/.config/blender/3.1/config/userpref.blend
Warning: Could not find a matching GPU name. Things may not behave as expected.
Detected OpenGL configuration:
Vendor: VMware, Inc.
Renderer: SVGA3D; build: RELEASE;  LLVM;
Read blend: /home/dev/Downloads/Birdie.blend
/home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/stencilTableFactory.h:297:54: runtime error: downcast of address 0x60b00060eee0 which does not point to an object of type 'StencilTable'
0x60b00060eee0: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 26 02 80 7b  40 cf e2 31 00 00 00 00  c0 00 00 00 be be be be  00 84 5c 05 d0 62 00 00  8c 16 5d 05
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
pc_0xee214ad###func_OpenSubdiv::v3_4_3::Far::StencilTableFactory::Create(OpenSubdiv::v3_4_3::Far::TopologyRefiner const&, OpenSubdiv::v3_4_3::Far::StencilTableFactoryReal<float>::Options)###file_/home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/stencilTableFactory.h###line_297###obj_(blender+0xee214ad)
pc_0xee1dd88###func_openSubdiv_createEvaluatorInternal(OpenSubdiv_TopologyRefiner*, eOpenSubdivEvaluator, OpenSubdiv_EvaluatorCacheImpl*)###file_/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc###line_448###obj_(blender+0xee1dd88)
pc_0xee1768f###func_openSubdiv_createEvaluatorFromTopologyRefiner###file_/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_capi.cc###line_246###obj_(blender+0xee1768f)
pc_0x45de4e3###func_BKE_subdiv_eval_begin###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_eval.c###line_75###obj_(blender+0x45de4e3)
pc_0x45e00b4###func_BKE_subdiv_eval_begin_from_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_eval.c###line_204###obj_(blender+0x45e00b4)
pc_0x460d40e###func_BKE_subdiv_to_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_mesh.c###line_1197###obj_(blender+0x460d40e)
pc_0x77d0b17###func_subdiv_as_mesh###file_/home/dev/blender-git/blender/source/blender/modifiers/intern/MOD_subsurf.c###line_178###obj_(blender+0x77d0b17)
pc_0x77d1b22###func_modifyMesh###file_/home/dev/blender-git/blender/source/blender/modifiers/intern/MOD_subsurf.c###line_273###obj_(blender+0x77d1b22)
pc_0x40d498c###func_BKE_modifier_modify_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/modifier.c###line_998###obj_(blender+0x40d498c)
pc_0x542510b###func_modifier_modify_mesh_and_geometry_set###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_875###obj_(blender+0x542510b)
pc_0x5428e15###func_mesh_calc_modifiers###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1224###obj_(blender+0x5428e15)
pc_0x543004f###func_mesh_build_data###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1847###obj_(blender+0x543004f)
pc_0x5431ca7###func_makeDerivedMesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1994###obj_(blender+0x5431ca7)
pc_0x42fd6fc###func_BKE_object_handle_data_update###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/object_update.c###line_194###obj_(blender+0x42fd6fc)
pc_0x430030f###func_BKE_object_eval_uber_data###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/object_update.c###line_392###obj_(blender+0x430030f)
pc_0x699af48###func_operator()###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc###line_1502###obj_(blender+0x699af48)
pc_0x69bebb2###func__M_invoke###file_/usr/include/c++/9/bits/std_function.h###line_300###obj_(blender+0x69bebb2)
pc_0x68f5f78###func_std::function<void (Depsgraph*)>::operator()(Depsgraph*) const###file_/usr/include/c++/9/bits/std_function.h###line_688###obj_(blender+0x68f5f78)
pc_0x68f1376###func_evaluate_node###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc###line_118###obj_(blender+0x68f1376)
pc_0x68f13c5###func_deg_task_run_func###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc###line_129###obj_(blender+0x68f13c5)
pc_0x21cfed0d###func_Task::operator()() const###file_/home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc###line_178###obj_(blender+0x21cfed0d)
pc_0x21d02417###func_tbb::internal::function_task<Task>::execute()###file_/home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h###line_1059###obj_(blender+0x21d02417)
pc_0x5d94044###func_tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long)###file_<null>###line_0###obj_(blender+0x5d94044)
pc_0x5d942fa###func_tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*)###file_<null>###line_0###obj_(blender+0x5d942fa)
pc_0x5d82ef6###func_tbb::internal::arena::process(tbb::internal::generic_scheduler&)###file_<null>###line_0###obj_(blender+0x5d82ef6)
pc_0x5d8dd2f###func_tbb::internal::market::process(rml::job&)###file_<null>###line_0###obj_(blender+0x5d8dd2f)
pc_0x5d8fd6b###func_tbb::internal::rml::private_worker::run()###file_<null>###line_0###obj_(blender+0x5d8fd6b)
pc_0x5d8ff68###func_tbb::internal::rml::private_worker::thread_routine(void*)###file_<null>###line_0###obj_(blender+0x5d8ff68)
pc_0x7f48f3fce608###func_start_thread###file_/build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c###line_477###obj_(libpthread.so.0+0x9608)
pc_0x7f48f39ae292###func___clone###file_<null>###line_0###obj_(libc.so.6+0x122292)

After 8 more of these stack traces the application quits.
I also deleted the subsurf modifier from the Cylinder object in the hope that OpenSubdiv is not called but still it's called.
As I am not sure if this is the cause of the crash I am trying to have ASAN to continue running nonethelesss (which doesn't work as advertised)
or to ignore this specific OpenSubdiv function call to see if there is another different ASAN violation.

EDIT: This is UBSAN of course, hang on

I can offer a little ASAN crash on Linux: ``` /home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender ndof: spacenavd not found Read prefs: /home/dev/.config/blender/3.1/config/userpref.blend Warning: Could not find a matching GPU name. Things may not behave as expected. Detected OpenGL configuration: Vendor: VMware, Inc. Renderer: SVGA3D; build: RELEASE; LLVM; Read blend: /home/dev/Downloads/Birdie.blend /home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/stencilTableFactory.h:297:54: runtime error: downcast of address 0x60b00060eee0 which does not point to an object of type 'StencilTable' 0x60b00060eee0: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' 26 02 80 7b 40 cf e2 31 00 00 00 00 c0 00 00 00 be be be be 00 84 5c 05 d0 62 00 00 8c 16 5d 05 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' pc_0xee214ad###func_OpenSubdiv::v3_4_3::Far::StencilTableFactory::Create(OpenSubdiv::v3_4_3::Far::TopologyRefiner const&, OpenSubdiv::v3_4_3::Far::StencilTableFactoryReal<float>::Options)###file_/home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/stencilTableFactory.h###line_297###obj_(blender+0xee214ad) pc_0xee1dd88###func_openSubdiv_createEvaluatorInternal(OpenSubdiv_TopologyRefiner*, eOpenSubdivEvaluator, OpenSubdiv_EvaluatorCacheImpl*)###file_/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc###line_448###obj_(blender+0xee1dd88) pc_0xee1768f###func_openSubdiv_createEvaluatorFromTopologyRefiner###file_/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_capi.cc###line_246###obj_(blender+0xee1768f) pc_0x45de4e3###func_BKE_subdiv_eval_begin###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_eval.c###line_75###obj_(blender+0x45de4e3) pc_0x45e00b4###func_BKE_subdiv_eval_begin_from_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_eval.c###line_204###obj_(blender+0x45e00b4) pc_0x460d40e###func_BKE_subdiv_to_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/subdiv_mesh.c###line_1197###obj_(blender+0x460d40e) pc_0x77d0b17###func_subdiv_as_mesh###file_/home/dev/blender-git/blender/source/blender/modifiers/intern/MOD_subsurf.c###line_178###obj_(blender+0x77d0b17) pc_0x77d1b22###func_modifyMesh###file_/home/dev/blender-git/blender/source/blender/modifiers/intern/MOD_subsurf.c###line_273###obj_(blender+0x77d1b22) pc_0x40d498c###func_BKE_modifier_modify_mesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/modifier.c###line_998###obj_(blender+0x40d498c) pc_0x542510b###func_modifier_modify_mesh_and_geometry_set###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_875###obj_(blender+0x542510b) pc_0x5428e15###func_mesh_calc_modifiers###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1224###obj_(blender+0x5428e15) pc_0x543004f###func_mesh_build_data###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1847###obj_(blender+0x543004f) pc_0x5431ca7###func_makeDerivedMesh###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc###line_1994###obj_(blender+0x5431ca7) pc_0x42fd6fc###func_BKE_object_handle_data_update###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/object_update.c###line_194###obj_(blender+0x42fd6fc) pc_0x430030f###func_BKE_object_eval_uber_data###file_/home/dev/blender-git/blender/source/blender/blenkernel/intern/object_update.c###line_392###obj_(blender+0x430030f) pc_0x699af48###func_operator()###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc###line_1502###obj_(blender+0x699af48) pc_0x69bebb2###func__M_invoke###file_/usr/include/c++/9/bits/std_function.h###line_300###obj_(blender+0x69bebb2) pc_0x68f5f78###func_std::function<void (Depsgraph*)>::operator()(Depsgraph*) const###file_/usr/include/c++/9/bits/std_function.h###line_688###obj_(blender+0x68f5f78) pc_0x68f1376###func_evaluate_node###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc###line_118###obj_(blender+0x68f1376) pc_0x68f13c5###func_deg_task_run_func###file_/home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc###line_129###obj_(blender+0x68f13c5) pc_0x21cfed0d###func_Task::operator()() const###file_/home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc###line_178###obj_(blender+0x21cfed0d) pc_0x21d02417###func_tbb::internal::function_task<Task>::execute()###file_/home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h###line_1059###obj_(blender+0x21d02417) pc_0x5d94044###func_tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long)###file_<null>###line_0###obj_(blender+0x5d94044) pc_0x5d942fa###func_tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*)###file_<null>###line_0###obj_(blender+0x5d942fa) pc_0x5d82ef6###func_tbb::internal::arena::process(tbb::internal::generic_scheduler&)###file_<null>###line_0###obj_(blender+0x5d82ef6) pc_0x5d8dd2f###func_tbb::internal::market::process(rml::job&)###file_<null>###line_0###obj_(blender+0x5d8dd2f) pc_0x5d8fd6b###func_tbb::internal::rml::private_worker::run()###file_<null>###line_0###obj_(blender+0x5d8fd6b) pc_0x5d8ff68###func_tbb::internal::rml::private_worker::thread_routine(void*)###file_<null>###line_0###obj_(blender+0x5d8ff68) pc_0x7f48f3fce608###func_start_thread###file_/build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c###line_477###obj_(libpthread.so.0+0x9608) pc_0x7f48f39ae292###func___clone###file_<null>###line_0###obj_(libc.so.6+0x122292) ``` After 8 more of these stack traces the application quits. I also deleted the subsurf modifier from the Cylinder object in the hope that OpenSubdiv is not called but still it's called. As I am not sure if this is the cause of the crash I am trying to have ASAN to continue running nonethelesss (which doesn't work as advertised) or to ignore this specific OpenSubdiv function call to see if there is another different ASAN violation. EDIT: This is UBSAN of course, hang on

Michael commented

2022-01-11 16:17:51 +01:00

Here is the real ASAN report:

dev@ubuvm2:~$ /home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender
ndof: spacenavd not found
Read prefs: /home/dev/.config/blender/3.1/config/userpref.blend
Warning: Could not find a matching GPU name. Things may not behave as expected.
Detected OpenGL configuration:
Vendor: VMware, Inc.
Renderer: SVGA3D; build: RELEASE;  LLVM;
Read blend: /home/dev/Downloads/Birdie.blend
/home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/patchTable.h:732:78: runtime error: downcast of address 0x60b0006123d0 which does not point to an object of type 'StencilTable'
0x60b0006123d0: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 f4 02 80 07  40 cf e2 31 00 00 00 00  00 00 00 00 be be be be  00 e1 be 00 60 62 00 00  bc 0e bf 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:488:12: runtime error: member call on address 0x60b000612320 which does not point to an object of type 'StencilTable'
0x60b000612320: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 72 01 80 57  40 cf e2 31 00 00 00 00  c0 00 00 00 be be be be  00 24 5d 05 d0 62 00 00  8c b6 5d 05
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
/home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/patchTable.h:745:69: runtime error: downcast of address 0x60b000612530 which does not point to an object of type 'StencilTable'
0x60b000612530: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 f4 02 80 07  40 cf e2 31 00 00 00 00  00 00 00 00 be be be be  00 82 cf 01 a0 62 00 00  a8 df cf 01
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:510:60: runtime error: member call on address 0x60b000612480 which does not point to an object of type 'StencilTable'
0x60b000612480: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 e9 01 80 6e  40 cf e2 31 00 00 00 00  18 01 00 00 be be be be  00 84 6c 01 e0 62 00 00  64 27 6d 01
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:546:10: runtime error: member call on address 0x60b000612740 which does not point to an object of type 'StencilTable'
0x60b000612740: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 ef 00 80 3a  40 cf e2 31 00 00 00 00  c0 00 00 00 be be be be  00 64 96 02 f0 62 00 00  48 24 97 02
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
/home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:549:12: runtime error: member call on address 0x60b000612690 which does not point to an object of type 'StencilTable'
0x60b000612690: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
 ef 00 80 3a  40 cf e2 31 00 00 00 00  18 01 00 00 be be be be  00 08 8c 00 10 63 00 00  0c 09 8d 00
              ^~~~~~~~~~~~~~~~~~~~~~~
              vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>'
=================================================================
==106428==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000383928 at pc 0x00001fefbb30 bp 0x7f985a4976b0 sp 0x7f985a4976a0
READ of size 16 at 0x612000383928 thread T18
    - 0 0x1fefbb2f in GPU_material_textures /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:502
    - 1 0x3eb37df in image_walk_gpu_materials /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:3407
    - 2 0x3eb4040 in image_walk_id_all_users /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:3435
    - 3 0x3ecd4d7 in BKE_image_user_id_eval_animation /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:5808
    - 4 0x6991446 in operator() /home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1142
    - 5 0x69bc3a7 in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 6 0x68f5f78 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 7 0x68f1376 in evaluate_node /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    - 8 0x68f13c5 in deg_task_run_func /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:129
    - 9 0x21cfed0d in Task::operator()() const /home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:178
    - 10 0x21d02417 in tbb::internal::function_task<Task>::execute() /home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    - 11 0x5d94044 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d94044)
    - 12 0x5d942fa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d942fa)
    - 13 0x5d82ef6 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d82ef6)
    - 14 0x5d8dd2f in tbb::internal::market::process(rml::job&) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8dd2f)
    - 15 0x5d8fd6b in tbb::internal::rml::private_worker::run() (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fd6b)
    - 16 0x5d8ff68 in tbb::internal::rml::private_worker::thread_routine(void*) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8ff68)
    - 17 0x7f9893141608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477
    #18 0x7f9892b21292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x612000383928 is located 104 bytes inside of 312-byte region [0x6120003838c0,0x6120003839f8)
freed by thread T0 here:
    - 0 0x7f989326d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    - 1 0x21d424c6 in MEM_lockfree_freeN /home/dev/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:130
    - 2 0x1fef69a5 in GPU_material_free /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:194
    - 3 0x400cfb0 in BKE_material_eval /home/dev/blender-git/blender/source/blender/blenkernel/intern/material.c:1860
    - 4 0x69a554c in operator() /home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1818
    - 5 0x69c1830 in _M_invoke /usr/include/c++/9/bits/std_function.h:300
    - 6 0x68f5f78 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688
    - 7 0x68f1376 in evaluate_node /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118
    - 8 0x68f13c5 in deg_task_run_func /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:129
    - 9 0x21cfed0d in Task::operator()() const /home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:178
    - 10 0x21d02417 in tbb::internal::function_task<Task>::execute() /home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    - 11 0x5d94044 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d94044)

previously allocated by thread T0 here:
    - 0 0x7f989326ddc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)
    - 1 0x21d42bb5 in MEM_lockfree_callocN /home/dev/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:236
    - 2 0x1fefc79c in GPU_material_from_nodetree /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:611
    - 3 0x6e0925c in DRW_shader_create_from_material /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager_shader.c:523
    - 4 0x6b3223e in eevee_material_get_ex /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_shaders.c:1478
    - 5 0x6b32c8a in EEVEE_material_get /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_shaders.c:1515
    - 6 0x6afb4ee in material_opaque /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:595
    - 7 0x6afee64 in eevee_material_cache_get /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:752
    - 8 0x6afee64 in EEVEE_materials_cache_populate /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:825
    - 9 0x6aa81de in EEVEE_cache_populate /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:126
    - 10 0x6a1f53d in drw_engines_cache_populate /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1087
    - 11 0x6a2534a in DRW_draw_render_loop_ex /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1702
    - 12 0x6a24431 in DRW_draw_view /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1614
    - 13 0xb714415 in view3d_draw_view /home/dev/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:1560
    - 14 0xb71459e in view3d_main_region_draw /home/dev/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:1582
    - 15 0x85a5aa4 in ED_region_do_draw /home/dev/blender-git/blender/source/blender/editors/screen/area.c:558
    - 16 0x5db1005 in wm_draw_window_offscreen /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:731
    - 17 0x5db2237 in wm_draw_window /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:881
    - 18 0x5db36a7 in wm_draw_update /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:1082
    - 19 0x5d9fe24 in WM_main /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm.c:645
    - 20 0x3d066ea in main /home/dev/blender-git/blender/source/creator/creator.c:560
    - 21 0x7f9892a260b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

Thread T18 created by T15 here:
    - 0 0x7f989319a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    - 1 0x5d8fc58 in tbb::internal::rml::private_server::wake_some(int) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fc58)
    #2 0x75fff  (<unknown module>)

Thread T15 created by T0 here:
    - 0 0x7f989319a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    - 1 0x5d8fc58 in tbb::internal::rml::private_server::wake_some(int) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fc58)
    #2 0x62d00009437f  (<unknown module>)

SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:502 in GPU_material_textures
Shadow bytes around the buggy address:
  0x0c24800686d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c24800686e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c24800686f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2480068700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2480068710: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c2480068720: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd
  0x0c2480068730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2480068740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2480068750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2480068760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2480068770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==106428==ABORTING

So the first heap-use-after-free is on the only line in this function:

ListBase GPU_material_textures(GPUMaterial *material)
{
  return material->graph.textures;
}

Here is the real ASAN report: ``` dev@ubuvm2:~$ /home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender ndof: spacenavd not found Read prefs: /home/dev/.config/blender/3.1/config/userpref.blend Warning: Could not find a matching GPU name. Things may not behave as expected. Detected OpenGL configuration: Vendor: VMware, Inc. Renderer: SVGA3D; build: RELEASE; LLVM; Read blend: /home/dev/Downloads/Birdie.blend /home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/patchTable.h:732:78: runtime error: downcast of address 0x60b0006123d0 which does not point to an object of type 'StencilTable' 0x60b0006123d0: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' f4 02 80 07 40 cf e2 31 00 00 00 00 00 00 00 00 be be be be 00 e1 be 00 60 62 00 00 bc 0e bf 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' /home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:488:12: runtime error: member call on address 0x60b000612320 which does not point to an object of type 'StencilTable' 0x60b000612320: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' 72 01 80 57 40 cf e2 31 00 00 00 00 c0 00 00 00 be be be be 00 24 5d 05 d0 62 00 00 8c b6 5d 05 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' /home/dev/blender-git/lib/linux_centos7_x86_64/opensubdiv/include/opensubdiv/far/patchTable.h:745:69: runtime error: downcast of address 0x60b000612530 which does not point to an object of type 'StencilTable' 0x60b000612530: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' f4 02 80 07 40 cf e2 31 00 00 00 00 00 00 00 00 be be be be 00 82 cf 01 a0 62 00 00 a8 df cf 01 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' /home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:510:60: runtime error: member call on address 0x60b000612480 which does not point to an object of type 'StencilTable' 0x60b000612480: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' e9 01 80 6e 40 cf e2 31 00 00 00 00 18 01 00 00 be be be be 00 84 6c 01 e0 62 00 00 64 27 6d 01 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' /home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:546:10: runtime error: member call on address 0x60b000612740 which does not point to an object of type 'StencilTable' 0x60b000612740: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' ef 00 80 3a 40 cf e2 31 00 00 00 00 c0 00 00 00 be be be be 00 64 96 02 f0 62 00 00 48 24 97 02 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' /home/dev/blender-git/blender/intern/opensubdiv/internal/evaluator/evaluator_impl.cc:549:12: runtime error: member call on address 0x60b000612690 which does not point to an object of type 'StencilTable' 0x60b000612690: note: object is of type 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' ef 00 80 3a 40 cf e2 31 00 00 00 00 18 01 00 00 be be be be 00 08 8c 00 10 63 00 00 0c 09 8d 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'OpenSubdiv::v3_4_3::Far::StencilTableReal<float>' ================================================================= ==106428==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000383928 at pc 0x00001fefbb30 bp 0x7f985a4976b0 sp 0x7f985a4976a0 READ of size 16 at 0x612000383928 thread T18 - 0 0x1fefbb2f in GPU_material_textures /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:502 - 1 0x3eb37df in image_walk_gpu_materials /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:3407 - 2 0x3eb4040 in image_walk_id_all_users /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:3435 - 3 0x3ecd4d7 in BKE_image_user_id_eval_animation /home/dev/blender-git/blender/source/blender/blenkernel/intern/image.c:5808 - 4 0x6991446 in operator() /home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1142 - 5 0x69bc3a7 in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 6 0x68f5f78 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 7 0x68f1376 in evaluate_node /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 - 8 0x68f13c5 in deg_task_run_func /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:129 - 9 0x21cfed0d in Task::operator()() const /home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:178 - 10 0x21d02417 in tbb::internal::function_task<Task>::execute() /home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 - 11 0x5d94044 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d94044) - 12 0x5d942fa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d942fa) - 13 0x5d82ef6 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d82ef6) - 14 0x5d8dd2f in tbb::internal::market::process(rml::job&) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8dd2f) - 15 0x5d8fd6b in tbb::internal::rml::private_worker::run() (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fd6b) - 16 0x5d8ff68 in tbb::internal::rml::private_worker::thread_routine(void*) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8ff68) - 17 0x7f9893141608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477 #18 0x7f9892b21292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292) 0x612000383928 is located 104 bytes inside of 312-byte region [0x6120003838c0,0x6120003839f8) freed by thread T0 here: - 0 0x7f989326d7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) - 1 0x21d424c6 in MEM_lockfree_freeN /home/dev/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:130 - 2 0x1fef69a5 in GPU_material_free /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:194 - 3 0x400cfb0 in BKE_material_eval /home/dev/blender-git/blender/source/blender/blenkernel/intern/material.c:1860 - 4 0x69a554c in operator() /home/dev/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1818 - 5 0x69c1830 in _M_invoke /usr/include/c++/9/bits/std_function.h:300 - 6 0x68f5f78 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/9/bits/std_function.h:688 - 7 0x68f1376 in evaluate_node /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:118 - 8 0x68f13c5 in deg_task_run_func /home/dev/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:129 - 9 0x21cfed0d in Task::operator()() const /home/dev/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:178 - 10 0x21d02417 in tbb::internal::function_task<Task>::execute() /home/dev/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 - 11 0x5d94044 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d94044) previously allocated by thread T0 here: - 0 0x7f989326ddc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6) - 1 0x21d42bb5 in MEM_lockfree_callocN /home/dev/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:236 - 2 0x1fefc79c in GPU_material_from_nodetree /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:611 - 3 0x6e0925c in DRW_shader_create_from_material /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager_shader.c:523 - 4 0x6b3223e in eevee_material_get_ex /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_shaders.c:1478 - 5 0x6b32c8a in EEVEE_material_get /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_shaders.c:1515 - 6 0x6afb4ee in material_opaque /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:595 - 7 0x6afee64 in eevee_material_cache_get /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:752 - 8 0x6afee64 in EEVEE_materials_cache_populate /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_materials.c:825 - 9 0x6aa81de in EEVEE_cache_populate /home/dev/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:126 - 10 0x6a1f53d in drw_engines_cache_populate /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1087 - 11 0x6a2534a in DRW_draw_render_loop_ex /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1702 - 12 0x6a24431 in DRW_draw_view /home/dev/blender-git/blender/source/blender/draw/intern/draw_manager.c:1614 - 13 0xb714415 in view3d_draw_view /home/dev/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:1560 - 14 0xb71459e in view3d_main_region_draw /home/dev/blender-git/blender/source/blender/editors/space_view3d/view3d_draw.c:1582 - 15 0x85a5aa4 in ED_region_do_draw /home/dev/blender-git/blender/source/blender/editors/screen/area.c:558 - 16 0x5db1005 in wm_draw_window_offscreen /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:731 - 17 0x5db2237 in wm_draw_window /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:881 - 18 0x5db36a7 in wm_draw_update /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm_draw.c:1082 - 19 0x5d9fe24 in WM_main /home/dev/blender-git/blender/source/blender/windowmanager/intern/wm.c:645 - 20 0x3d066ea in main /home/dev/blender-git/blender/source/creator/creator.c:560 - 21 0x7f9892a260b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) Thread T18 created by T15 here: - 0 0x7f989319a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805) - 1 0x5d8fc58 in tbb::internal::rml::private_server::wake_some(int) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fc58) #2 0x75fff (<unknown module>) Thread T15 created by T0 here: - 0 0x7f989319a805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805) - 1 0x5d8fc58 in tbb::internal::rml::private_server::wake_some(int) (/home/dev/blender-git/blender/cmake-build-debug--asan/bin/blender+0x5d8fc58) #2 0x62d00009437f (<unknown module>) SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/blender-git/blender/source/blender/gpu/intern/gpu_material.c:502 in GPU_material_textures Shadow bytes around the buggy address: 0x0c24800686d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c24800686e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c24800686f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2480068700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2480068710: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c2480068720: fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd fd fd 0x0c2480068730: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa 0x0c2480068740: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2480068750: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2480068760: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2480068770: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==106428==ABORTING ``` So the first heap-use-after-free is on the only line in this function: ``` ListBase GPU_material_textures(GPUMaterial *material) { return material->graph.textures; } ```

Jacques Lucke commented

2022-01-11 16:41:55 +01:00

Thanks. I still can't reproduce it, but the ASAN report seems useful. Does this fix it?

diff --git a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
index 1c09417e9ab..619306a570b 100644
--- a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
+++ b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc
@@ -1475,6 +1475,16 @@ void DepsgraphRelationBuilder::build_animation_images(ID *id)
         id, NodeType::IMAGE_ANIMATION, OperationCode::IMAGE_ANIMATION);
     TimeSourceKey time_src_key;
     add_relation(time_src_key, image_animation_key, "TimeSrc -> Image Animation");
+
+    /* The image users of these ids may change during evaluation. */
+    if (GS(id->name) == ID_MA) {
+      OperationKey material_update_key(id, NodeType::SHADING, OperationCode::MATERIAL_UPDATE);
+      add_relation(material_update_key, image_animation_key, "Material Update -> Image Animation");
+    }
+    else if (GS(id->name) == ID_WO) {
+      OperationKey world_update_key(id, NodeType::SHADING, OperationCode::WORLD_UPDATE);
+      add_relation(world_update_key, image_animation_key, "World Update -> Image Animation");
+    }
   }
 }

Thanks. I still can't reproduce it, but the ASAN report seems useful. Does this fix it? ``` diff --git a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc index 1c09417e9ab..619306a570b 100644 --- a/source/blender/depsgraph/intern/builder/deg_builder_relations.cc +++ b/source/blender/depsgraph/intern/builder/deg_builder_relations.cc @@ -1475,6 +1475,16 @@ void DepsgraphRelationBuilder::build_animation_images(ID *id) id, NodeType::IMAGE_ANIMATION, OperationCode::IMAGE_ANIMATION); TimeSourceKey time_src_key; add_relation(time_src_key, image_animation_key, "TimeSrc -> Image Animation"); + + /* The image users of these ids may change during evaluation. */ + if (GS(id->name) == ID_MA) { + OperationKey material_update_key(id, NodeType::SHADING, OperationCode::MATERIAL_UPDATE); + add_relation(material_update_key, image_animation_key, "Material Update -> Image Animation"); + } + else if (GS(id->name) == ID_WO) { + OperationKey world_update_key(id, NodeType::SHADING, OperationCode::WORLD_UPDATE); + add_relation(world_update_key, image_animation_key, "World Update -> Image Animation"); + } } } ```

Michael commented

2022-01-11 17:30:59 +01:00

Yes, with your diff applied ASAN does not not crash anymore on Linux!