Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor is over the strip
Closed, ArchivedPublic
Actions

Description

System Information
Windows 10

Blender Version
Broken: Blender 2.79b

Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor overlaps the strip, so only when you're extending a video or an image strip.

It happens often but I can't reproduce the bug 100% of the time. Sometimes it'll insta crash with any strip, sometimes it'll work. Even on minimal projects, e.g. with only one video or image strip.

See attached blend

Select a video, image or audio strip linked to an effect strip
Place the time cursor so it overlaps the strip
Press E to extend the strip
Press Ctrl to snap, Blender crashes

Blend file:

time-extend-crash.zip348 KBDownload

It's my first time reporting a bug here, please tell me if you need anything else or I should provide more/different info :)

Event Timeline

Nathan Lovato (gdquest) created this task.Apr 30 2018, 3:13 AM

Nathan Lovato (gdquest) updated the task description. (Show Details)

Can confirm crash here.

Confirmed on first sight (took me a while to reproduce this though), will have a closer look later (or get help onboard if I cant find a fix)

1  BKE_nlastrip_find_active nla.c             1106 0x26427d3 
2  BKE_nla_tweakedit_remap  nla.c             545  0x26418b3 
3  doAnimEdit_SnapFrame     transform.c       8101 0x19f149b 
4  applyTimeTranslateValue  transform.c       8284 0x19f1cde 
5  applyTimeTranslate       transform.c       8309 0x19f1e74 
6  transformApply           transform.c       2374 0x19cdf6c 
7  transform_modal          transform_ops.c   412  0x1a273de 
8  wm_handler_operator_call wm_event_system.c 1743 0x1810934 
9  wm_handlers_do_intern    wm_event_system.c 2156 0x181199e 
10 wm_handlers_do           wm_event_system.c 2195 0x1811a97 
11 wm_event_do_handlers     wm_event_system.c 2481 0x1812737 
12 WM_main                  wm.c              522  0x1805dfe 
13 main                     creator.c         539  0x1800822

Hm, something weird (at least for my experience) going on with memory corruption?
I was debugging in QTCreator and for the above backtrace [previous post -- where it crashes in BKE_nlastrip_find_active] the NlaTrack pointer was 0x2?

I've got two other backtraces:
In the first one again NlaTrack pointer is again not NULL but cant be resolved to a NlaTrack either

1  BKE_nlatrack_find_active nla.c             926  0x26423c1 
2  BKE_nla_tweakedit_remap  nla.c             542  0x26418cf 
3  doAnimEdit_SnapFrame     transform.c       8101 0x19f14a1 
4  applyTimeTranslateValue  transform.c       8284 0x19f1ce4 
5  applyTimeTranslate       transform.c       8309 0x19f1e7a 
6  transformApply           transform.c       2374 0x19cdf72 
7  transform_modal          transform_ops.c   412  0x1a273e4 
8  wm_handler_operator_call wm_event_system.c 1743 0x1810934 
9  wm_handlers_do_intern    wm_event_system.c 2156 0x181199e 
10 wm_handlers_do           wm_event_system.c 2195 0x1811a97 
11 wm_event_do_handlers     wm_event_system.c 2481 0x1812737 
12 WM_main                  wm.c              522  0x1805dfe 
13 main                     creator.c         539  0x1800822

this one might be unrelated (still posting it here...)

1  BLI_ghashIterator_getKey             BLI_ghash.h          137  0x29846a3 
2  check_unused_keys                    moviecache.c         150  0x29846a3 
3  IMB_moviecache_cleanup               moviecache.c         477  0x29850bb 
4  BKE_sequencer_cache_cleanup_sequence seqcache.c           153  0x26bec91 
5  sequence_do_invalidate_dependent     sequencer.c          4100 0x26e3037 
6  sequence_invalidate_cache            sequencer.c          4135 0x26e3127 
7  BKE_sequence_invalidate_dependent    sequencer.c          4145 0x26e3181 
8  recalcData_sequencer                 transform_generics.c 983  0x1a1b387 
9  recalcData                           transform_generics.c 1034 0x1a1b529 
10 applyTimeTranslate                   transform.c          8311 0x19f1e89 
11 transformApply                       transform.c          2374 0x19cdf72 
12 transform_modal                      transform_ops.c      412  0x1a273e4 
13 wm_handler_operator_call             wm_event_system.c    1743 0x1810934 
14 wm_handlers_do_intern                wm_event_system.c    2156 0x181199e 
15 wm_handlers_do                       wm_event_system.c    2195 0x1811a97 
16 wm_event_do_handlers                 wm_event_system.c    2481 0x1812737 
17 WM_main                              wm.c                 522  0x1805dfe 
18 main                                 creator.c            539  0x1800822

maybe a look with ASAN helps, gonna try later...

ASAN gives me

Read blend: /time-extend-crash/entend-strip-crash.blend
=================================================================
==31734==ERROR: AddressSanitizer: heap-use-after-free on address 0x6030000f1270 at pc 0x000003bf85c8 bp 0x7ffc118a8770 sp 0x7ffc118a8760
READ of size 4 at 0x6030000f1270 thread T0
    #0 0x3bf85c7 in BKE_nla_tweakedit_remap /blender/source/blender/blenkernel/intern/nla.c:532
    #1 0x1bd4bcb in doAnimEdit_SnapFrame /blender/source/blender/editors/transform/transform.c:8101
    #2 0x1bd629d in applyTimeTranslateValue /blender/source/blender/editors/transform/transform.c:8284
    #3 0x1bd67c6 in applyTimeTranslate /blender/source/blender/editors/transform/transform.c:8309
    #4 0x1b7939b in transformApply /blender/source/blender/editors/transform/transform.c:2374
    #5 0x1c6a85b in transform_modal /blender/source/blender/editors/transform/transform_ops.c:412
    #6 0x16fc73c in wm_handler_operator_call /blender/source/blender/windowmanager/intern/wm_event_system.c:1743
    #7 0x16ff0e1 in wm_handlers_do_intern /blender/source/blender/windowmanager/intern/wm_event_system.c:2156
    #8 0x16ff236 in wm_handlers_do /blender/source/blender/windowmanager/intern/wm_event_system.c:2195
    #9 0x17010cb in wm_event_do_handlers /blender/source/blender/windowmanager/intern/wm_event_system.c:2481
    #10 0x16e04cf in WM_main /blender/source/blender/windowmanager/intern/wm.c:522
    #11 0x16d579b in main /blender/source/creator/creator.c:539
    #12 0x7f4aafda8f29 in __libc_start_main (/lib64/libc.so.6+0x20f29)
    #13 0x16d4a59 in _start (/build_279/bin/blender+0x16d4a59)

0x6030000f1270 is located 0 bytes inside of 32-byte region [0x6030000f1270,0x6030000f1290)
freed by thread T0 here:
    #0 0x7f4abaf314b8 in __interceptor_free (/lib64/libasan.so.4+0xde4b8)
    #1 0x7f4ab0fcd183  (/lib64/libX11.so.6+0x43183)

previously allocated by thread T0 here:
    #0 0x7f4abaf31850 in malloc (/lib64/libasan.so.4+0xde850)
    #1 0x7f4aa6b0f6cb  (/lib64/libxcb.so.1+0xe6cb)

checking for NULL doesnt seems to help in these places, I'm afraid I have to pass this on to @Joshua Leung (aligorith) ...

Can not reproduce in 2.8. Also pressing ctrl had no effect.

Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor is over the stripClosed, ArchivedPublicActions

Description

Event Timeline

Ctrl snapping a strip in transform / Time_Extend mode crashes Blender instantly if the time cursor is over the strip
Closed, ArchivedPublic
Actions