Page MenuHome

Crash on Drag Collection color over to Collections
Closed, ResolvedPublicBUG

Description

System Information
Operating system: Darwin-19.6.0-x86_64-i386-64bit 64 Bits
Graphics card: AMD Radeon Pro Vega 48 OpenGL Engine ATI Technologies Inc. 4.1 ATI-3.10.18

Blender Version
Broken: version: 2.91.0 Alpha, branch: master, commit date: 2020-10-08 22:15, hash: rB2d5e38d4ece9
Worked: (newest version of Blender that worked as expected)

Short description of error
[Please fill out a short description of the error here]

Exact steps for others to reproduce the error
[Please describe the exact steps needed to reproduce the issue]
[Based on the default startup or an attached .blend file (as simple as possible)]

Inside Preferences / Themes / click on Collection Colors. Click and drag (I used Purple) over to a Collection under Scene Collection. Upon arriving at the boundary of the 3D Viewport, Blender will crash.
Obviously this is not the intended way to color each Collection with an individual color ... the intended method is not apparent since clicking on any of the colors seems to do nothing.

Event Timeline

I can confirm this crash with the current master. This can be reproduced by attempting to drag any color over to the outliner, not just from the theme preferences.

@Paul Muns (dznwks) In case this wasn't clear, the theme settings only allow you to configure the preset colors. Assigning a color to a collection is done by right-clicking on a collection in the outliner and then picking one of the color tags.

datastack_drop_init(bContext * C, const wmEvent * event, StackDropData * drop_data) Line 715	C
datastack_drop_poll(bContext * C, wmDrag * drag, const wmEvent * event, const unsigned char * * r_tooltip) Line 859	C
dropbox_active(bContext * C, ListBase * handlers, wmDrag * drag, const wmEvent * event) Line 208	C
wm_dropbox_active(bContext * C, wmDrag * drag, const wmEvent * event) Line 238	C
wm_drop_operator_options(bContext * C, wmDrag * drag, const wmEvent * event) Line 264	C
wm_drags_check_ops(bContext * C, const wmEvent * event) Line 284	C
wm_event_do_handlers(bContext * C) Line 3365	C
WM_main(bContext * C) Line 486	C
main(int argc, const unsigned char * * UNUSED_argv_c) Line 523	C
Robert Guetzkow (rjg) changed the task status from Needs Triage to Confirmed.Oct 10 2020, 12:28 AM
Robert Guetzkow (rjg) triaged this task as High priority.

Sorry Robert, now that I see how beautiful the menu is after RT-clicking the Collection, I feel kinda dumb. However, so many graphics programs allow this kind of drag'n'drop that it is like an atavistic action to try it. I hope it is easy to fix.

It appears that datastack_drop_poll doesn't check that drag->type matches the expected type and always interprets the pointer in drag->poin as a pointer to StackDropData. This is obviously not correct in case the drag and drop is for e.g. color. Interpreting the memory it points to as pointer and attempting to dereference it in datastack_drop_init by using drop_data->drag_tselem->type results in the segmentation fault.

Adding the following check to datastack_drop_poll should avoid this issue:

if (drag->type != WM_DRAG_ID) {
   return false;
}

I will post a diff shortly.

Julian Eisel (Severin) changed the subtype of this task from "Report" to "Bug".Oct 12 2020, 5:01 PM
Paul Muns (dznwks) changed the task status from Resolved to Archived.Oct 13 2020, 2:35 AM

Sorry but I just downloaded the latest version and tried it a couple of times with the same result. I fear that every item in Preferences might be susceptible to this problem. Then again, how many are stupid enough to try this? Maybe time better spent elsewhere for now?

Robert Guetzkow (rjg) changed the task status from Archived to Resolved.EditedOct 13 2020, 10:48 AM

@Paul Muns (dznwks) I've committed the change to master on October 13 at 01:17 AM CEST, so the patch wasn't included in the last daily build. Check again tomorrow and it should be fixed. If you do find other cases that cause a crash with drag and drop, please create a new bug report.