**System Information**
Operating system: Windows-10-10.0.19041-SP0 64 Bits
Graphics card: GeForce RTX 2080 SUPER/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 456.71, Linux 5.8.12-200.fc32.x86_64, Fedora 32 |
**Blender Version**
Broken: version: 2.91.0 Alpha, branch: master, commit date: 2020-10-14 05:21, hash: `rB2d4f1afece18`
Worked: (newest version of Blender that worked as expected)
**Short description of error**
When typing on the Property Search textbox it crash to the desktop.
On the steps to reproduce the error, you can find the stack trace and more info on where this happens in a debug build (release build crashes in a different point)Blender crashes to the desktop.
**Exact steps for others to reproduce the error**
- Enable the "Auto Tile Size" addon. Cycles does not need to be registered.
- Reopen blender and start typing in the property search box.
- In debug builds Blender crashes on the first few characters. In release builds it can require some more typing and deleting. Typing quickly is more likely to cause the crash.
**ASAN Report**
```lines=10
==440319==ERROR: AddressSanitizer: heap-use-after-free on address 0x6100006afce0 at pc 0x0000034afb76 bp 0x7fffffffc4a0 sp 0x7fffffffc490
READ of size 4 at 0x6100006afce0 thread T0
#0 0x34afb75 in ctx_data_get /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302
#1 0x34b09dc in ctx_data_pointer_verify /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:394
#2 0x34b74ad in CTX_data_scene /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:1043
#3 0x60291e0 in rna_Context_scene_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_context.c:146
#4 0x602a1e3 in Context_scene_get /home/hans/Documents/Blender-Git/build_linux_debug/source/blender/makesrna/intern/rna_context_gen.c:160
#5 0x5eb72f5 in RNA_property_pointer_get /home/hans/Documents/Blender-Git/blender/source/blender/makesrna/intern/rna_access.c:3725
#6 0x69c59cd in pyrna_prop_to_py /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:1577
#7 0x69dc4ca in pyrna_struct_getattro /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_rna.c:4244
#8 0x342fb7c in _PyEval_EvalFrameDefault Python/ceval.c:2573
#9 0x3429b4a in function_code_fastcall Objects/call.c:283
#10 0x342ade4 in call_function Python/ceval.c:4616
#11 0x342f4b3 in _PyEval_EvalFrameDefault Python/ceval.c:3124
#12 0x3429b4a in function_code_fastcall Objects/call.c:283
#13 0x1d851597 in _PyFunction_FastCallDict Objects/call.c:322
#14 0x6a1236d in bpy_app_generic_callback /home/hans/Documents/Blender-Git/blender/source/blender/python/intern/bpy_app_handlers.c:350
#15 0x3483203 in BKE_callback_exec /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:42
#16 0x3483577 in BKE_callback_exec_id_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/callbacks.c:74
Open blender and start typing on the property search, on debug it crashes on the first few characters, on release, it can require some more typing and deleting to make it crash. Typing quickly is more likely to cause the crash. #17 0x3ad3bfc in scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1534
Both stack traces for each build type are below. #18 0x3ad3cb1 in BKE_scene_graph_update_tagged /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/scene.c:1568
#19 0x47216d4 in wm_event_do_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:360
#20 0x4721a2a in wm_event_do_refresh_wm_and_depsgraph /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:386
#21 0x4723a59 in wm_event_do_notifiers /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_event_system.c:567
#22 0x470f39e in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:486
#23 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
#24 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308
#25 0x34335fd in _start (/home/hans/Documents/Blender-Git/build_linux_debug/bin/blender+0x34335fd)
Stack trac0x6100006afce0 is located 160 bytes inside of debug build192-byte region [0x6100006afc40,0x6100006afd00)
```linesfreed by thread T0 here:
python37_d.dll!00007ffed622f68d() (Unknown Source:0 #0 0x7ffff766f307 in __interceptor_free (/lib64/libasan.so.6+0xb0307)
python37_d.dll!00007ffed622f850() (Unknown Source:0) #1 0x1f1287aa in rem_memblock /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:1019
blender.exe!BPY_context_member_get(bContext * C, const unsigned char * member, bContextDataResult * result) Line 562 (d:\dev\blender\blender\source\blender\python\intern\bpy_interface.c:562) #2 0x1f127774 in MEM_guarded_freeN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:908
blender.exe!ctx_data_get(bContext * C, const unsigned char * member, bContextDataResult * result) Line 308 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:308) #3 0x1aeb358c in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:439
blender.exe!ctx_data_pointer_verify(const bContext * C, const unsigned char * member, void * * pointer) Line 394 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:394) #4 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454
blender.exe!CTX_data_scene(const bContext * C) Line 1043 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:1043) #5 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504
blender.exe!rna_Context_scene_get(PointerRNA * ptr) Line 146 (d:\dev\blender\blender\source\blender\makesrna\intern\rna_context.c:146) #6 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512
blender.exe!Context_scene_get(PointerRNA * ptr) Line 158 (d:\dev\blender\build_Debug\source\blender\makesrna\intern\rna_context_gen.c:158) #7 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684
blender.exe!RNA_property_pointer_get(PointerRNA * ptr, PropertyRNA * prop) Line 3725 (d:\dev\blender\blender\source\blender\makesrna\intern\rna_access.c:3725) #8 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872
blender.exe!pyrna_prop_to_py(PointerRNA * ptr, PropertyRNA * prop) Line 1577 (d:\dev\blender\blender\source\blender\python\intern\bpy_rna.c:1577) #9 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075
blender.exe!pyrna_struct_getattro(BPy_StructRNA * self, _object * pyname) Line 4244 (d:\dev\blender\blender\source\blender\python\intern\bpy_rna.c:4244) #10 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489
python37_d.dll!00007ffed62a1f6f() (Unknown Source:0) #11 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
python37_d.dll!00007ffed63ee5c4() (Unknown Source:0) #12 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308
previously allocated by thread T0 here:
python37_d.dll!00007ffed62174fb() (Unknown Source:0 #0 0x7ffff766f667 in __interceptor_malloc (/lib64/libasan.so.6+0xb0667)
python37_d.dll!00007ffed62132ec() (Unknown Source:0) #1 0x1f1251ca in MEM_guarded_mallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:454
python37_d.dll!00007ffed63f42df() (Unknown Source:0) #2 0x1f123fa8 in MEM_guarded_dupallocN /home/hans/Documents/Blender-Git/blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:267
python37_d.dll!00007ffed63eabd7() (Unknown Source:0) #3 0x34ae6a7 in CTX_copy /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:116
python37_d.dll!00007ffed62174fb() (Unknown Source:0) #4 0x1aeb25a2 in property_search_all_tabs /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:404
python37_d.dll!00007ffed621294f() (Unknown Source:0) #5 0x1aeb3766 in buttons_main_region_property_search /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:454
python37_d.dll!00007ffed6211f7d() (Unknown Source:0) #6 0x1aeb43c9 in buttons_main_region_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/space_buttons/space_buttons.c:504
``` #7 0x6aa44bc in ED_region_do_layout /home/hans/Documents/Blender-Git/blender/source/blender/editors/screen/area.c:512
#8 0x471b6bb in wm_draw_window_offscreen /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:684
#9 0x471cfc4 in wm_draw_window /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:872
#10 0x471e41f in wm_draw_update /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm_draw.c:1075
#11 0x470f3aa in WM_main /home/hans/Documents/Blender-Git/blender/source/blender/windowmanager/intern/wm.c:489
#12 0x34341fd in main /home/hans/Documents/Blender-Git/blender/source/creator/creator.c:519
#13 0x7ffff7054041 in __libc_start_main ../csu/libc-start.c:308
Release build stack traceSUMMARY: AddressSanitizer: heap-use-after-free /home/hans/Documents/Blender-Git/blender/source/blender/blenkernel/intern/context.c:302 in ctx_data_get
Shadow bytes around the buggy address:
0x0c20800cdf40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c20800cdf50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c20800cdf60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c20800cdf70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c20800cdf80: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c20800cdf90: fd fd fd fd fd fd fd fd fd fd fd fd[fd]fd fd fd
0x0c20800cdfa0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c20800cdfb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c20800cdfc0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c20800cdfd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
```lines 0x0c20800cdfe0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
blender.exe!ctx_data_get(bContext * C, const unsigned char * member, bContextDataResult * result) Line 350 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:350)Shadow byte legend (one shadow byte represents 8 application bytes):
blender.exe!ctx_data_pointer_verify(const bContext * C, const unsigned char * member, void * * pointer) Line 394 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:394) Addressable: 00
blender.exe!CTX_data_scene(const bContext * C) Line 1043 (d:\dev\blender\blender\source\blender\blenkernel\intern\context.c:1043) Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
blender.exe!rna_Context_scene_get(PointerRNA * ptr) Line 146 (d:\dev\blender\blender\source\blender\makesrna\intern\rna_context.c:146) Freed heap region: fd
blender.exe!Context_scene_get(PointerRNA * ptr) Line 158 (d:\dev\blender\build_RelWithDebInfo\source\blender\makesrna\intern\rna_context_gen.c:158) Stack left redzone: f1
blender.exe!RNA_property_pointer_get(PointerRNA * ptr, PropertyRNA * prop) Line 3736 (d:\dev\blender\blender\source\blender\makesrna\intern\rna_access.c:3736) Stack mid redzone: f2
blender.exe!pyrna_prop_to_py(PointerRNA * ptr, PropertyRNA * prop) Line 1577 (d:\dev\blender\blender\source\blender\python\intern\bpy_rna.c:1577) Stack right redzone: f3
blender.exe!pyrna_struct_getattro(BPy_StructRNA * self, _object * pyname) Line 4244 (d:\dev\blender\blender\source\blender\python\intern\bpy_rna.c:4244) Stack after return: f5
python37.dll!00007ffed6890a82() (Unknown Source:0) Stack use after scope: f8
python37.dll!00007ffed67c6685() (Unknown Source:0) Global redzone: f9
python37.dll!00007ffed67c6a22() (Unknown Source:0) Global init order: f6
python37.dll!00007ffed68942bf() (Unknown Source:0) Poisoned by user: f7
python37.dll!00007ffed688f286() (Unknown Source:0) Container overflow: fc
python37.dll!00007ffed67c6685() (Unknown Source:0) Array cookie: ac
blender.exe!bpy_app_generic_callback(Main * UNUSED_main, PointerRNA * * pointers, const int num_pointers, void * arg) Line 350 (d:\dev\blender\blender\source\blender\python\intern\bpy_app_handlers.c:350) Intra object redzone: bb
blender.exe!BKE_callback_exec(Main * bmain, PointerRNA * * pointers, const int num_pointers, eCbEvent evt) Line 42 (d:\dev\blender\blender\source\blender\blenkernel\intern\callbacks.c:42) ASan internal: fe
blender.exe!BKE_callback_exec_id_depsgraph(Main * bmain, ID * id, Depsgraph * depsgraph, eCbEvent evt) Line 75 (d:\dev\blender\blender\source\blender\blenkernel\intern\callbacks.c:75) Left alloca redzone: ca
blender.exe!scene_graph_update_tagged(Depsgraph * depsgraph, Main * bmain, bool only_if_tagged) Line 1548 (d:\dev\blender\blender\source\blender\blenkernel\intern\scene.c:1548) Right alloca redzone: cb
blender.exe!wm_event_do_depsgraph(bContext * C, bool is_after_open_file) Line 360 (d:\dev\blender\blender\source\blender\windowmanager\intern\wm_event_system.c:360) Shadow gap: cc
blender.exe!wm_event_do_refresh_wm_and_depsgraph(bContext * C) Line 388 (d:\dev\blender\blender\source\blender\windowmanager\intern\wm_event_system.c:388)==440319==ABORTING
```