Page MenuHome
Create Task
Maniphest T86799

2.92 crashes when Duplicating Object inside Collection used for Boolean (set to "Fast" Solver)
Closed, ResolvedPublic
Actions

Description

System Information
Operating system: Windows 10 19042.867
Graphics card: 2080 Ti (dual card)

Blender Version
Broken: 2.92.0
Worked: 2.91.1

Short description of error
When I use Boole Modifier and set Operand Type: Collection, I am only able to have one object in the collection, when the Boole Solver is set to "Fast". As soon as I duplicate the object in the collection the program crashes.

Exact steps for others to reproduce the error
I have recreated this in the attached file (simply duplicate the selected object to see what I mean).

blender_crashing.blend1 MBDownload

Revisions and Commits

rB Blender
rB315582f28cef Fix T86799: Boolean crashes duplicating object with "Fast" solver

Event Timeline

Ryan Rickett (glencandle) created this task.Mar 21 2021, 6:59 PM
Ryan Rickett (glencandle) updated the task description. (Show Details)
Ryan Rickett (glencandle) renamed this task from 2.92 crashes when Duplicating Object inside Collection used for Boole to 2.92 crashes when Duplicating Object inside Collection used for Boole (set to "Fast" Solver).Mar 21 2021, 7:35 PM
Ryan Rickett (glencandle) updated the task description. (Show Details)
Falk David (filedescriptor) changed the task status from Needs Triage to Confirmed.Mar 22 2021, 2:14 PM
Falk David (filedescriptor) added projects: Modeling, Modifiers.
Falk David (filedescriptor) added a subscriber: Falk David (filedescriptor).

I can confirm this on the latest 2.93.0 Alpha, branch: master, commit date: 2021-03-22 11:23, hash: rBc4c195672ddd.

When using ASAN, this will consistently crash. Here is the report:

==70822==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060025c1518 at pc 0x000005662fe8 bp 0x7fffffffb4a0 sp 0x7fffffffb490
READ of size 8 at 0x6060025c1518 thread T0
    #0 0x5662fe7 in BM_mesh_bm_from_me /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490
    #1 0x659f3f8 in BMD_mesh_bm_create /.../blender/source/blender/modifiers/intern/MOD_boolean.c:274
    #2 0x65b1677 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:835
    #3 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    #4 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    #5 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    #6 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    #7 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    #8 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    #9 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    #10 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #11 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    #12 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    #13 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    #14 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    #15 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #16 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #17 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    #18 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #19 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    #20 0x21f83698 in void tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
    #21 0x21f8335f in tbb::interface7::internal::return_type_or_void<Task::operator()() const::{lambda()#1}>::type tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
    #22 0x21f83115 in Task::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    #23 0x21f84283 in tbb::internal::function_task<Task>::execute() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
    #24 0x51cb3f4 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) (/.../build_linux_debug/bin/blender+0x51cb3f4)
    #25 0x51cb6aa in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) (/.../build_linux_debug/bin/blender+0x51cb6aa)
    #26 0x664127b in tbb::task::wait_for_all() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820
    #27 0x664320b in tbb::internal::task_group_base::wait() /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168
    #28 0x21f80c66 in tbb_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:257
    #29 0x21f821bc in BLI_task_pool_work_and_wait /.../blender/source/blender/blenlib/intern/task_pool.cc:506
    #30 0x203af4b0 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:397
    #31 0x202cdabb in deg_flush_updates_and_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58
    #32 0x202cdc4f in DEG_evaluate_on_refresh /.../blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73
    #33 0x3d2f1ff in scene_graph_update_tagged /.../blender/source/blender/blenkernel/intern/scene.c:2642
    #34 0x3d2f331 in BKE_scene_graph_evaluated_ensure /.../blender/source/blender/blenkernel/intern/scene.c:2686
    #35 0x906246d in createTransData /.../blender/source/blender/editors/transform/transform_convert.c:1408
    #36 0x903cc6a in initTransform /.../blender/source/blender/editors/transform/transform.c:1738
    #37 0x9260e74 in transformops_data /.../blender/source/blender/editors/transform/transform_ops.c:393
    #38 0x9261a25 in transform_invoke /.../blender/source/blender/editors/transform/transform_ops.c:509
    #39 0x527e398 in wm_macro_invoke_internal /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:363
    #40 0x527e85a in wm_macro_invoke /.../blender/source/blender/windowmanager/intern/wm_operator_type.c:388
    #41 0x51f5909 in wm_operator_invoke /.../blender/source/blender/windowmanager/intern/wm_event_system.c:1350
    #42 0x51fdffd in wm_handler_operator_call /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2178
    #43 0x5201b23 in wm_handlers_do_keymap_with_keymap_handler /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2503
    #44 0x52052d7 in wm_handlers_do_intern /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2799
    #45 0x52067f3 in wm_handlers_do /.../blender/source/blender/windowmanager/intern/wm_event_system.c:2931
    #46 0x520c40e in wm_event_do_handlers /.../blender/source/blender/windowmanager/intern/wm_event_system.c:3421
    #47 0x51d70c3 in WM_main /.../blender/source/blender/windowmanager/intern/wm.c:646
    #48 0x364c819 in main /.../blender/source/creator/creator.c:520
    #49 0x7ffff6e48cb1 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x28cb1)
    #50 0x364b9cd in _start (/.../build_linux_debug/bin/blender+0x364b9cd)

0x6060025c1518 is located 0 bytes to the right of 56-byte region [0x6060025c14e0,0x6060025c1518)
freed by thread T0 here:
    #0 0x7ffff76801b7 in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.6+0xb01b7)
    #1 0x21fc19ca in MEM_lockfree_freeN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:129
    #2 0x21b1635c in BLI_mempool_destroy /.../blender/source/blender/blenlib/intern/BLI_mempool.c:765
    #3 0x21acca98 in BLI_ghash_free /.../blender/source/blender/blenlib/intern/BLI_ghash.c:1016
    #4 0xa74cfd9 in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:1657
    #5 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428
    #6 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837
    #7 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    #8 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    #9 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    #10 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    #11 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    #12 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    #13 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    #14 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #15 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    #16 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    #17 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    #18 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    #19 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #20 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #21 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    #22 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #23 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    #24 0x7fffffffcb1f  ([stack]+0x1fb1f)

previously allocated by thread T0 here:
    #0 0x7ffff7680517 in malloc (/lib/x86_64-linux-gnu/libasan.so.6+0xb0517)
    #1 0x21fc2424 in MEM_lockfree_mallocN /.../blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:276
    #2 0x21b11f57 in BLI_mempool_create /.../blender/source/blender/blenlib/intern/BLI_mempool.c:275
    #3 0x21ac5891 in ghash_new /.../blender/source/blender/blenlib/intern/BLI_ghash.c:447
    #4 0x21ac7bc0 in BLI_ghash_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash.c:712
    #5 0x21ad2aad in BLI_ghash_ptr_new_ex /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:215
    #6 0x21ad2ad0 in BLI_ghash_ptr_new /.../blender/source/blender/blenlib/intern/BLI_ghash_utils.c:219
    #7 0xa741aaf in BM_mesh_intersect /.../blender/source/blender/bmesh/tools/bmesh_intersect.c:994
    #8 0x65a4b05 in BMD_mesh_intersection /.../blender/source/blender/modifiers/intern/MOD_boolean.c:428
    #9 0x65b1713 in modifyMesh /.../blender/source/blender/modifiers/intern/MOD_boolean.c:837
    #10 0x39fa779 in BKE_modifier_modify_mesh /.../blender/source/blender/blenkernel/intern/modifier.c:1055
    #11 0x4c32ead in modifier_modify_mesh_and_geometry_set /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:930
    #12 0x4c360b0 in mesh_calc_modifiers /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1304
    #13 0x4c3d065 in mesh_build_data /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:1922
    #14 0x4c3ecba in makeDerivedMesh /.../blender/source/blender/blenkernel/intern/DerivedMesh.cc:2070
    #15 0x3b3500c in BKE_object_handle_data_update /.../blender/source/blender/blenkernel/intern/object_update.c:195
    #16 0x3b37d82 in BKE_object_eval_uber_data /.../blender/source/blender/blenkernel/intern/object_update.c:381
    #17 0x2041b11e in operator() /.../blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1351
    #18 0x20448e07 in __invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:60
    #19 0x20441c7f in __invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_object_data_geometry(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*> /usr/include/c++/10/bits/invoke.h:110
    #20 0x2043b016 in _M_invoke /usr/include/c++/10/bits/std_function.h:291
    #21 0x203b15e0 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/10/bits/std_function.h:622
    #22 0x203acbb1 in evaluate_node /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113
    #23 0x203acbff in deg_task_run_func /.../blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124
    #24 0x21f83044 in Task::operator()() const::{lambda()#1}::operator()() const /.../blender/source/blender/blenlib/intern/task_pool.cc:118
    #25 0x21f843e0 in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const /.../lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
    #26 0x51ba594 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/.../build_linux_debug/bin/blender+0x51ba594)
    #27 0x7fffffffcb1f  ([stack]+0x1fb1f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /.../blender/source/blender/bmesh/intern/bmesh_mesh_convert.c:490 in BM_mesh_bm_from_me
Shadow bytes around the buggy address:
  0x0c0c804b0250: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b0260: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c804b0270: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c0c804b0280: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b0290: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
=>0x0c0c804b02a0: fd fd fd[fa]fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c804b02b0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b02c0: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
  0x0c0c804b02d0: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
  0x0c0c804b02e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c0c804b02f0: fd fd fd fd fd fd fd fa fa fa fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==70822==ABORTING
Philipp Oeser (lichtwerk) triaged this task as High priority.Mar 22 2021, 4:34 PM
Philipp Oeser (lichtwerk) added a subscriber: Philipp Oeser (lichtwerk).

Think this deserves to be High priority.

Philipp Oeser (lichtwerk) renamed this task from 2.92 crashes when Duplicating Object inside Collection used for Boole (set to "Fast" Solver) to 2.92 crashes when Duplicating Object inside Collection used for Boolean (set to "Fast" Solver).Mar 22 2021, 4:34 PM
Lukas Tönne (lukastoenne) added a subscriber: Lukas Tönne (lukastoenne).Apr 2 2021, 4:46 PM

This crashes because BM_mesh_bm_from_me expects the input Mesh data block to have valid selection indices. If that's not the case then the face table it uses causes out-of-bounds crash.
The outcome of the first collection step is already incorrect (MSelect contains invalid index), but the inverse BM_mesh_bm_to_me function does not care. It's only in the 2nd collection step when the Mesh block is reused that things fall apart.
What causes the incorrect indices is that BM_mesh_intersect reduces the number of faces (from 224 of the operand mesh to 6 of the intersection), but does not correct selection indices of the BMesh to match.

I'm unsure about expected behavior regarding selection:

  1. If invalid selection indices are allowed in BMesh and Mesh data blocks then BM_mesh_bm_from_me should check before accessing the face table: https://developer.blender.org/diffusion/B/browse/master/source/blender/bmesh/intern/bmesh_mesh_convert.c$484
  2. If invalid selection indices are not allowed in BMesh then BM_mesh_intersect should additionally correct selection indices
  3. If invalid selection indices are allowed in BMesh but not Mesh then BM_mesh_bm_to_me should correct selection indices
Campbell Barton (campbellbarton) closed this task as Resolved by committing rB315582f28cef: Fix T86799: Boolean crashes duplicating object with "Fast" solver.Apr 29 2021, 4:59 PM
Campbell Barton (campbellbarton) claimed this task.
Campbell Barton (campbellbarton) added a commit: rB315582f28cef: Fix T86799: Boolean crashes duplicating object with "Fast" solver.