Page MenuHome
Create Task
Maniphest T83614

Rendering animation using "Generate" type modifiers after animated displacement texture crashes Blender
Confirmed, NormalPublicBUG
Actions

Description

System Information
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce GTX 1650/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 460.79

Blender Version
Broken: version: 2.92.0 Alpha, branch: master, commit date: 2020-12-09 01:29, hash: rB9b11a7776f2a
Worked: 2.83.10

Short description of error
If 2 high poly (~100k faces per obj) objects in modifiers properties have after Displacement modifier (with animated texture) "Generate" type modifiers (I've tried Boolean and Decimate), Blender cant run Animation render (but still can run Image render).
Crash happens on 2.9 and higher. I've tested this on 2.83.10 LTS (from steam) and everything worked fine there.
Crashes with Decimate a little bit hard to recreate. So I will go with steps for "Boolean crash"

Exact steps for others to reproduce the error

  • create Cude, Empty and Icosphere
  • Add Subdivision mod. to Cube: set it to "Simple" and 7 levels
  • Add Displacement mod. to Cube and set texture (Clouds) coordinates to object - Empty
  • Add Boolean mod. (difference) and select object Icosphere
  • Select Cude with Icosphere and duplicate them
  • Save and press Render Animation

bug.blend812 KBDownload

bug.crash.txt8 KBDownload

==3883==ERROR: AddressSanitizer: heap-use-after-free on address 0x61500034ec08 at pc 0x000016fc795d bp 0x7fffc19dd6c0 sp 0x7fffc19dd6b0
READ of size 8 at 0x61500034ec08 thread T15
    #0 0x16fc795c in blender::gpu::GLBatch::verts_(int) const /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.hh:112
    #1 0x17013501 in blender::gpu::GLVertArray::update_bindings(unsigned int, GPUBatch const*, blender::gpu::ShaderInterface const*, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_array.cc:124
    #2 0x16fa900b in blender::gpu::GLVaoCache::vao_get(GPUBatch*) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:273
    #3 0x16fa84d8 in blender::gpu::GLVaoCache::base_instance_vao_get(GPUBatch*, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:234
    #4 0x16fa9d3e in blender::gpu::GLBatch::bind(int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:317
    #5 0x16fa9f3f in blender::gpu::GLBatch::draw(int, int, int, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:328
    #6 0x16eca2be in GPU_batch_draw_advanced /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_batch.cc:282
    #7 0x16fc1207 in blender::gpu::GLDrawList::append(GPUBatch*, int, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_drawlist.cc:122
    #8 0x16efa9f5 in GPU_draw_list_append /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_drawlist.cc:52
    #9 0x5978acc in draw_indirect_call /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:598
    #10 0x5978acc in draw_call_batching_flush /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:795
    #11 0x597c5f0 in draw_call_batching_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:891
    #12 0x597eae7 in draw_shgroup /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1056
    #13 0x597f89f in drw_draw_pass_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1113
    #14 0x597fe50 in DRW_draw_pass /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1153
    #15 0x5c51bc0 in EEVEE_velocity_resolve /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_effects.c:466
    #16 0x5c5202b in EEVEE_draw_effects /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_effects.c:486
    #17 0x5a21f42 in EEVEE_render_draw /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_render.c:671
    #18 0x59b1dbc in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:559
    #19 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #20 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #21 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #22 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #23 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #24 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #25 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #26 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #27 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #28 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #29 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #30 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
    #31 0x7ffff6f46292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61500034ec08 is located 8 bytes inside of 512-byte region [0x61500034ec00,0x61500034ee00)
freed by thread T15 here:
    #0 0x7ffff76927cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x18e0eab0 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    #2 0x16ef56c6 in blender::gpu::GLVertBuf::operator delete(void*) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:57
    #3 0x17018021 in blender::gpu::GLVertBuf::~GLVertBuf() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:35
    #4 0x16f8bb19 in blender::gpu::VertBuf::reference_remove() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer_private.hh:94
    #5 0x16f877f5 in GPU_vertbuf_discard /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:161
    #6 0x5a0eab8 in EEVEE_motion_blur_cache_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_motion_blur.c:449
    #7 0x59b1bef in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:542
    #8 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #9 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #10 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #11 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #12 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #13 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #14 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #15 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #16 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #17 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #18 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #19 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T15 here:
    #0 0x7ffff7692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x18e0f510 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    #2 0x16ef5676 in blender::gpu::GLVertBuf::operator new(unsigned long) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:57
    #3 0x16ef70a2 in blender::gpu::GLBackend::vertbuf_alloc() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_backend.hh:121
    #4 0x16f85d10 in blender::gpu::VertBuf::duplicate() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:77
    #5 0x16f8750d in GPU_vertbuf_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:149
    #6 0x5a0ee06 in EEVEE_motion_blur_cache_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_motion_blur.c:467
    #7 0x59b1953 in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:507
    #8 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #9 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #10 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #11 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #12 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #13 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #14 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #15 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #16 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #17 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #18 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #19 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

Thread T15 created by T0 here:
    #0 0x7ffff75bf805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    #1 0x18de42b9 in BLI_threadpool_insert /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:245
    #2 0x4fee516 in WM_jobs_start /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:484
    #3 0xd7b88bd in screen_render_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:1041
    #4 0x4f8f3ba in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293
    #5 0x4f912f2 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500
    #6 0x4f91551 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    #7 0x90f1c95 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932
    #8 0x917b8d0 in ui_handler_region_menu /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10809
    #9 0x4f88a9b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636
    #10 0x4f9ec36 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757
    #11 0x4f9fc78 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865
    #12 0x4fa537f in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288
    #13 0x4f732cf in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    #14 0x34f58fa in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    #15 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.hh:112 in blender::gpu::GLBatch::verts_(int) const
Shadow bytes around the buggy address:
  0x0c2a80061d30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2a80061d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2a80061d80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061db0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a80061dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc

Related Objects

Event Timeline

Nicolas Macilvoy (Macilvoy) created this task.Dec 10 2020, 6:44 AM
Robert Guetzkow (rjg) changed the task status from Needs Triage to Confirmed.EditedDec 10 2020, 10:48 AM
Robert Guetzkow (rjg) added a project: Modeling.
Robert Guetzkow (rjg) added a subscriber: Robert Guetzkow (rjg).

I can reproduce an issue in a debug build based on rb3a23f18e02eb and rBe795ba1529a2 even when rendering a still image, when creating a project based on your instructions.

T83614.blend788 KBDownload

_BLI_assert_abort() Lines 51	C
blender::Set<int,4,blender::PythonProbingStrategy<1,0>,blender::DefaultHash<int>,blender::DefaultEquality,blender::SimpleSetSlot<int>,blender::GuardedAllocator>::add_new__impl<int const &>(const int & key, const unsigned __int64 hash) Lines 693	C++
blender::Set<int,4,blender::PythonProbingStrategy<1,0>,blender::DefaultHash<int>,blender::DefaultEquality,blender::SimpleSetSlot<int>,blender::GuardedAllocator>::add_new(const int & key) Lines 245	C++
blender::meshintersect::Cell::add_patch(int p) Lines 405	C++
blender::meshintersect::find_cells_from_edge(const blender::meshintersect::IMesh & tm, const blender::meshintersect::TriMeshTopology & tmtopo, blender::meshintersect::PatchesInfo & pinfo, blender::meshintersect::CellsInfo & cinfo, const blender::meshintersect::Edge e) Lines 1141	C++
blender::meshintersect::find_cells(const blender::meshintersect::IMesh & tm, const blender::meshintersect::TriMeshTopology & tmtopo, blender::meshintersect::PatchesInfo & pinfo) Lines 1193	C++
blender::meshintersect::boolean_trimesh(blender::meshintersect::IMesh & tm_in, blender::meshintersect::BoolOpType op, int nshapes, std::function<int __cdecl(int)> shape_fn, bool use_self, blender::meshintersect::IMeshArena * arena) Lines 3372	C++
blender::meshintersect::boolean_mesh(blender::meshintersect::IMesh & imesh, blender::meshintersect::BoolOpType op, int nshapes, std::function<int __cdecl(int)> shape_fn, bool use_self, blender::meshintersect::IMesh * imesh_triangulated, blender::meshintersect::IMeshArena * arena) Lines 3488	C++
blender::meshintersect::bmesh_boolean(BMesh * bm, BMLoop *[3] * looptris, const int looptris_tot, int(*)(BMFace *, void *) test_fn, void * user_data, int nshapes, const bool use_self, const bool use_separate_all, const bool keep_hidden, const blender::meshintersect::BoolOpType boolean_mode) Lines 391	C++
BM_mesh_boolean(BMesh * bm, BMLoop *[3] * looptris, const int looptris_tot, int(*)(BMFace *, void *) test_fn, void * user_data, const int nshapes, const bool use_self, const bool keep_hidden, const int boolean_mode) Lines 453	C++
BMD_mesh_intersection(BMesh * bm, ModifierData * md, const ModifierEvalContext * ctx, Mesh * mesh_operand_ob, Object * object, Object * operand_ob, bool is_flip) Lines 420	C
modifyMesh(ModifierData * md, const ModifierEvalContext * ctx, Mesh * mesh) Lines 677	C
BKE_modifier_modify_mesh(ModifierData * md, const ModifierEvalContext * ctx, Mesh * me) Lines 1055	C
mesh_calc_modifiers(Depsgraph * depsgraph, Scene * scene, Object * ob, int useDeform, const bool need_mapping, const CustomData_MeshMasks * dataMask, const int index, const bool use_cache, const bool allow_shared_mesh, Mesh * * r_deform, Mesh * * r_final) Lines 1183	C
mesh_build_data(Depsgraph * depsgraph, Scene * scene, Object * ob, const CustomData_MeshMasks * dataMask, const bool need_mapping) Lines 1806	C
makeDerivedMesh(Depsgraph * depsgraph, Scene * scene, Object * ob, BMEditMesh * em, const CustomData_MeshMasks * dataMask) Lines 1927	C
BKE_object_handle_data_update(Depsgraph * depsgraph, Scene * scene, Object * ob) Lines 194	C
BKE_object_eval_uber_data(Depsgraph * depsgraph, Scene * scene, Object * ob) Lines 385	C
 	[External Code]	
blender::deg::`anonymous namespace'::evaluate_node(const blender::deg::`anonymous-namespace'::DepsgraphEvalState * state, blender::deg::OperationNode * operation_node) Lines 115	C++
blender::deg::`anonymous namespace'::deg_task_run_func(TaskPool * pool, void * taskdata) Lines 127	C++
Task::()::__l2::<Lambdafunktion>() Lines 118	C++
tbb::interface7::internal::delegated_function<void <Lambdafunktion>(void) const ,void>::operator()() Lines 94	C++
 	[External Code]	
tbb::interface7::internal::isolate_impl<void,void <Lambdafunktion>(void) const>(const Task::()::__l2::void <Lambdafunktion>(void) & f) Lines 161	C++
tbb::interface7::this_task_arena::isolate<void <Lambdafunktion>(void)>(const Task::()::__l2::void <Lambdafunktion>(void) & f) Lines 396	C++
Task::operator()() Lines 122	C++
tbb::internal::function_task<Task>::execute() Lines 1049	C++
 	[External Code]	
tbb::task::wait_for_all() Lines 810	C++
tbb::internal::task_group_base::wait() Lines 168	C++
tbb_task_pool_work_and_wait(TaskPool * pool) Lines 253	C++
BLI_task_pool_work_and_wait(TaskPool * pool) Lines 500	C++
blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph * graph) Lines 398	C++
deg_flush_updates_and_refresh(blender::deg::Depsgraph * deg_graph) Lines 59	C++
DEG_evaluate_on_framechange(Depsgraph * graph, float ctime) Lines 83	C++
BKE_scene_graph_update_for_newframe(Depsgraph * depsgraph) Lines 2663	C
engine_depsgraph_init(RenderEngine * engine, ViewLayer * view_layer) Lines 621	C
engine_render_view_layer(Render * re, RenderEngine * engine, ViewLayer * view_layer_iter, const bool use_engine, const bool use_grease_pencil) Lines 770	C
RE_engine_render(Render * re, int do_all) Lines 918	C
do_render_3d(Render * re) Lines 1133	C
do_render(Render * re) Lines 1212	C
do_render_composite(Render * re) Lines 1350	C
do_render_all_options(Render * re) Lines 1618	C
RE_RenderFrame(Render * re, Main * bmain, Scene * scene, ViewLayer * single_layer, Object * camera_override, int frame, const bool write_still) Lines 2017	C
render_startjob(void * rjv, short * stop, short * do_update, float * progress) Lines 639	C
do_job_thread(void * job_v) Lines 390	C
tslot_thread_start(void * tslot_p) Lines 232	C++
 	[External Code]
Robert Guetzkow (rjg) updated the task description. (Show Details)Dec 10 2020, 10:50 AM
Robert Guetzkow (rjg) added a comment.EditedDec 10 2020, 10:53 AM

Your debug log seems to be missing debug symbols. Could you please repeat your test with an official non-Steam build, just to make sure that we're finding the same issue.

The stack trace in my previous comment is from a file created with your instructions. This file does not seem to crash in Blender 2.91.0. However, the file you've uploaded crashes in 2.91.0 for still and animation renders on my machine. The crash with that file seems to happen in the Nvidia driver though, like your log file indicates as well.

Robert Guetzkow (rjg) changed the task status from Confirmed to Needs Information from User.Dec 10 2020, 10:58 AM
Robert Guetzkow (rjg) added a comment.EditedDec 10 2020, 12:09 PM

This seems like I might have found an unrelated problem in my first stack trace. Debugging your file with a Linux build and ASAN, detects a use-after-free.

Note: This was tested in a VM, I'll try this again on my laptop to rule out a fluke due to graphics driver issues.

==3883==ERROR: AddressSanitizer: heap-use-after-free on address 0x61500034ec08 at pc 0x000016fc795d bp 0x7fffc19dd6c0 sp 0x7fffc19dd6b0
READ of size 8 at 0x61500034ec08 thread T15
    #0 0x16fc795c in blender::gpu::GLBatch::verts_(int) const /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.hh:112
    #1 0x17013501 in blender::gpu::GLVertArray::update_bindings(unsigned int, GPUBatch const*, blender::gpu::ShaderInterface const*, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_array.cc:124
    #2 0x16fa900b in blender::gpu::GLVaoCache::vao_get(GPUBatch*) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:273
    #3 0x16fa84d8 in blender::gpu::GLVaoCache::base_instance_vao_get(GPUBatch*, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:234
    #4 0x16fa9d3e in blender::gpu::GLBatch::bind(int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:317
    #5 0x16fa9f3f in blender::gpu::GLBatch::draw(int, int, int, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.cc:328
    #6 0x16eca2be in GPU_batch_draw_advanced /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_batch.cc:282
    #7 0x16fc1207 in blender::gpu::GLDrawList::append(GPUBatch*, int, int) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_drawlist.cc:122
    #8 0x16efa9f5 in GPU_draw_list_append /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_drawlist.cc:52
    #9 0x5978acc in draw_indirect_call /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:598
    #10 0x5978acc in draw_call_batching_flush /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:795
    #11 0x597c5f0 in draw_call_batching_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:891
    #12 0x597eae7 in draw_shgroup /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1056
    #13 0x597f89f in drw_draw_pass_ex /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1113
    #14 0x597fe50 in DRW_draw_pass /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager_exec.c:1153
    #15 0x5c51bc0 in EEVEE_velocity_resolve /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_effects.c:466
    #16 0x5c5202b in EEVEE_draw_effects /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_effects.c:486
    #17 0x5a21f42 in EEVEE_render_draw /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_render.c:671
    #18 0x59b1dbc in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:559
    #19 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #20 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #21 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #22 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #23 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #24 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #25 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #26 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #27 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #28 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #29 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #30 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
    #31 0x7ffff6f46292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x61500034ec08 is located 8 bytes inside of 512-byte region [0x61500034ec00,0x61500034ee00)
freed by thread T15 here:
    #0 0x7ffff76927cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
    #1 0x18e0eab0 in MEM_lockfree_freeN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    #2 0x16ef56c6 in blender::gpu::GLVertBuf::operator delete(void*) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:57
    #3 0x17018021 in blender::gpu::GLVertBuf::~GLVertBuf() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:35
    #4 0x16f8bb19 in blender::gpu::VertBuf::reference_remove() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer_private.hh:94
    #5 0x16f877f5 in GPU_vertbuf_discard /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:161
    #6 0x5a0eab8 in EEVEE_motion_blur_cache_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_motion_blur.c:449
    #7 0x59b1bef in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:542
    #8 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #9 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #10 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #11 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #12 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #13 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #14 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #15 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #16 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #17 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #18 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #19 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

previously allocated by thread T15 here:
    #0 0x7ffff7692bc8 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
    #1 0x18e0f510 in MEM_lockfree_mallocN /home/dev/01-data/01-git/blender-git/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    #2 0x16ef5676 in blender::gpu::GLVertBuf::operator new(unsigned long) /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_vertex_buffer.hh:57
    #3 0x16ef70a2 in blender::gpu::GLBackend::vertbuf_alloc() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_backend.hh:121
    #4 0x16f85d10 in blender::gpu::VertBuf::duplicate() /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:77
    #5 0x16f8750d in GPU_vertbuf_duplicate /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/intern/gpu_vertex_buffer.cc:149
    #6 0x5a0ee06 in EEVEE_motion_blur_cache_finish /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_motion_blur.c:467
    #7 0x59b1953 in eevee_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/engines/eevee/eevee_engine.c:507
    #8 0x5948820 in DRW_render_to_image /home/dev/01-data/01-git/blender-git/blender/source/blender/draw/intern/draw_manager.c:1909
    #9 0x14ff1d77 in engine_render_view_layer /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:786
    #10 0x14ff40a3 in RE_engine_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/engine.c:914
    #11 0x1501aafb in do_render_3d /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1132
    #12 0x1501c24a in do_render /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1209
    #13 0x1501e036 in do_render_composite /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1349
    #14 0x15022789 in do_render_all_options /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:1615
    #15 0x15027839 in RE_RenderFrame /home/dev/01-data/01-git/blender-git/blender/source/blender/render/intern/pipeline.c:2015
    #16 0xd7b42cf in render_startjob /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:630
    #17 0x4fed4f1 in do_job_thread /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:389
    #18 0x18de408d in tslot_thread_start /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:231
    #19 0x7ffff7566608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477

Thread T15 created by T0 here:
    #0 0x7ffff75bf805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
    #1 0x18de42b9 in BLI_threadpool_insert /home/dev/01-data/01-git/blender-git/blender/source/blender/blenlib/intern/threads.cc:245
    #2 0x4fee516 in WM_jobs_start /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_jobs.c:484
    #3 0xd7b88bd in screen_render_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/render/render_internal.c:1041
    #4 0x4f8f3ba in wm_operator_invoke /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1293
    #5 0x4f912f2 in wm_operator_call_internal /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1500
    #6 0x4f91551 in WM_operator_name_call_ptr /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:1548
    #7 0x90f1c95 in ui_apply_but_funcs_after /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:932
    #8 0x917b8d0 in ui_handler_region_menu /home/dev/01-data/01-git/blender-git/blender/source/blender/editors/interface/interface_handlers.c:10809
    #9 0x4f88a9b in wm_handler_ui_call /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:636
    #10 0x4f9ec36 in wm_handlers_do_intern /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2757
    #11 0x4f9fc78 in wm_handlers_do /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:2865
    #12 0x4fa537f in wm_event_do_handlers /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:3288
    #13 0x4f732cf in WM_main /home/dev/01-data/01-git/blender-git/blender/source/blender/windowmanager/intern/wm.c:635
    #14 0x34f58fa in main /home/dev/01-data/01-git/blender-git/blender/source/creator/creator.c:522
    #15 0x7ffff6e4b0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)

SUMMARY: AddressSanitizer: heap-use-after-free /home/dev/01-data/01-git/blender-git/blender/source/blender/gpu/opengl/gl_batch.hh:112 in blender::gpu::GLBatch::verts_(int) const
Shadow bytes around the buggy address:
  0x0c2a80061d30: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d40: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d60: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa
  0x0c2a80061d70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c2a80061d80: fd[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061d90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061da0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061db0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2a80061dc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2a80061dd0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
Robert Guetzkow (rjg) changed the task status from Needs Information from User to Confirmed.Dec 10 2020, 2:03 PM
Robert Guetzkow (rjg) edited projects, added EEVEE & Viewport; removed Modeling.
Robert Guetzkow (rjg) added a project: Modeling.
Robert Guetzkow (rjg) updated the task description. (Show Details)Dec 10 2020, 2:06 PM
Robert Guetzkow (rjg) added a comment.Dec 10 2020, 2:34 PM

I've created a separate ticket for the Boolean modifier assert T83630.

Nicolas Macilvoy (Macilvoy) added a comment.Dec 10 2020, 8:45 PM

Thank You! Sorry that I'm late to provide info. I just woke up. T83630 was resolved so I guess no logs are needed now.

Robert Guetzkow (rjg) added a comment.Dec 10 2020, 9:07 PM

@Nicolas Macilvoy (Macilvoy) No worries. I originally meant the log files for this ticket, but as I was able to catch the issue with ASAN, this should be all that we need.

Campbell Barton (campbellbarton) changed the subtype of this task from "Report" to "Bug".Jan 19 2021, 7:29 AM