Page MenuHome

Segfault on undo-ing mode switching and bone duplication
Closed, ResolvedPublicBUG

Description

System Information
Operating system: Linux-5.8.0-7642-generic-x86_64-with-glibc2.32 64 Bits
Graphics card: GeForce RTX 2080/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 460.56

Blender Version
Broken: version: 3.0.0 Alpha, branch: master, commit date: 2021-04-16 14:21, hash: rBc7a8bcfa37fa

Caused by rB4c7b1766a7f1: Fix undo steps not allowing re-using old BMain in non-global undo.

Short description of error
Seems to be an easily reproducible segfault from an assert. Only happens with the Duplicate Bone operator afaict, not with Extrude bone or so.

Stack:

BLI_assert failed: source/blender/blenkernel/intern/armature_update.c:762, pose_pchan_get_indexed(), at 'pchan_index < MEM_allocN_len(pose->chan_array) / sizeof(bPoseChannel *)'

Thread 31 "blender" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffcafff640 (LWP 1688296)]
0x0000000003a6bc30 in BKE_pose_eval_bone (depsgraph=0x7fffc4771408, scene=0x7fffc47d4408, object=0x7fffc2b0f808, pchan_index=366)
    at /media/data/blender_guest/blender_master/source/blender/blenkernel/intern/armature_update.c:837
837	    if (pchan->constraints.first == NULL) {
#0  0x0000000003a6bc30 in BKE_pose_eval_bone
    (depsgraph=0x7fffc4771408, scene=0x7fffc47d4408, object=0x7fffc2b0f808, pchan_index=366)
    at /media/data/blender_guest/blender_master/source/blender/blenkernel/intern/armature_update.c:837
#1  0x000000000e4a8514 in operator()(Depsgraph*) const (__closure=0x7fffc36c6380, depsgraph=0x7fffc4771408)
    at /media/data/blender_guest/blender_master/source/blender/depsgraph/intern/builder/deg_builder_nodes_rig.cc:239
#2  0x000000000e4ac7a0 in std::__invoke_impl<void, blender::deg::DepsgraphNodeBuilder::build_rig(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*>(std::__invoke_other, struct {...} &) (__f=...) at /usr/include/c++/10/bits/invoke.h:60
#3  0x000000000e4ab798 in std::__invoke_r<void, blender::deg::DepsgraphNodeBuilder::build_rig(Object*, bool)::<lambda(Depsgraph*)>&, Depsgraph*>(struct {...} &) (__fn=...) at /usr/include/c++/10/bits/invoke.h:110
#4  0x000000000e4aa600 in std::_Function_handler<void(Depsgraph*), blender::deg::DepsgraphNodeBuilder::build_rig(Object*, bool)::<lambda(Depsgraph*)> >::_M_invoke(const std::_Any_data &, Depsgraph *&&) (__functor=..., __args#0=@0x7fffcafb90e0: 0x7fffc4771408)
    at /usr/include/c++/10/bits/std_function.h:291
#5  0x000000000e47b38f in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const
    (this=0x7fffc29c57c8, __args#0=0x7fffc4771408) at /usr/include/c++/10/bits/std_function.h:622
#6  0x000000000e47a5c0 in blender::deg::(anonymous namespace)::evaluate_node(blender::deg::(anonymous namespace)::DepsgraphEvalState const*, blender::deg::OperationNode*) (state=0x7fffffffe080, operation_node=0x7fffc29c5708)
    at /media/data/blender_guest/blender_master/source/blender/depsgraph/intern/eval/deg_eval.cc:113
#7  0x000000000e47a60a in blender::deg::(anonymous namespace)::deg_task_run_func(TaskPool*, void*)
    (pool=0x7fffb88c8288, taskdata=0x7fffc29c5708)
    at /media/data/blender_guest/blender_master/source/blender/depsgraph/intern/eval/deg_eval.cc:124
--Type <RET> for more, q to quit, c to continue without paging--c
#8  0x00000000104c017e in Task::operator()() const::{lambda()#1}::operator()() const (__closure=0x7fffcafb9270) at /media/data/blender_guest/blender_master/source/blender/blenlib/intern/task_pool.cc:118
#9  0x00000000104c05fe in tbb::interface7::internal::delegated_function<Task::operator()() const::{lambda()#1} const, void>::operator()() const (this=0x7fffcafb9200) at /media/data/blender_guest/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96
#10 0x0000000003b86ec5 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) ()
#11 0x00000000104c0383 in tbb::interface7::internal::isolate_impl<void, Task::operator()() const::{lambda()#1} const>(Task::operator()() const::{lambda()#1} const&) (f=...) at /media/data/blender_guest/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216
#12 0x00000000104c0289 in tbb::interface7::this_task_arena::isolate<Task::operator()() const::{lambda()#1}>(tbb::interface7::internal::return_type_or_void const&) (f=...) at /media/data/blender_guest/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472
#13 0x00000000104c01b5 in Task::operator()() const (this=0x7fffc8c0d6c8) at /media/data/blender_guest/blender_master/source/blender/blenlib/intern/task_pool.cc:118
#14 0x00000000104c05d6 in tbb::internal::function_task<Task>::execute() (this=0x7fffc8c0d6c0) at /media/data/blender_guest/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059
#15 0x0000000003b97d25 in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::process_bypass_loop(tbb::internal::context_guard_helper<false>&, tbb::task*, long) ()
#16 0x0000000003b97fdb in tbb::internal::custom_scheduler<tbb::internal::IntelSchedulerTraits>::local_wait_for_all(tbb::task&, tbb::task*) ()
#17 0x0000000003b86bd7 in tbb::internal::arena::process(tbb::internal::generic_scheduler&) ()
#18 0x0000000003b91a10 in tbb::internal::market::process(rml::job&) ()
#19 0x0000000003b93a4c in tbb::internal::rml::private_worker::run() ()
#20 0x0000000003b93c49 in tbb::internal::rml::private_worker::thread_routine(void*) ()
#21 0x00007ffff7f86590 in start_thread (arg=0x7fffcafff640) at pthread_create.c:463
#22 0x00007ffff7964223 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Exact steps for others to reproduce the error

  1. Create an armature
  2. Enter edit mode
  3. Duplicate bone
  4. Undo x2 should crash.

Event Timeline

Hi @Demeter Dzadik (Mets), I can confirm the crash for 3.0.0 alpha, Hash : 112fb77157e.
I noticed steps are slightly different to reproduce the crash.

  • select armature head, duplicate it.
  • then duplicate the armature.
  • hit undo 3x times
Pratik Borhade (PratikPB2123) changed the task status from Needs Triage to Confirmed.Apr 19 2021, 6:22 PM
Philipp Oeser (lichtwerk) triaged this task as High priority.Apr 27 2021, 5:21 PM
Philipp Oeser (lichtwerk) changed the subtype of this task from "Report" to "Bug".

Caused by rB4c7b1766a7f1

Not a problem with legacy Undo (experimental User Preference).
Not a problem with disabled Global Undo.

@Bastien Montagne (mont29): I think there was a report about this before (cannot find it though)

Will dare setting to High prio since it is a regression and we have the culprit commit.