Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
==23579==ERROR: AddressSanitizer: heap-use-after-free on address 0x6110005aa2c8 at pc 0x55bcaf170111 bp 0x7ffca319dc50 sp 0x7ffca319dc40
READ of size 4 at 0x6110005aa2c8 thread T0
#0 0x55bcaf170110 in pbvh_has_mask /home/mark/storage/code/blender/source/blender/blenkernel/intern/pbvh.c:2352
#1 0x55bcaf1703d9 in pbvh_show_diffuse_color_set /home/mark/storage/code/blender/source/blender/blenkernel/intern/pbvh.c:2367
#2 0x55bcaf076a0e in BKE_sculpt_update_mesh_elements /home/mark/storage/code/blender/source/blender/blenkernel/intern/paint.c:936
#3 0x55bcae17625c in SCULPT_cache_populate /home/mark/storage/code/blender/source/blender/draw/modes/sculpt_mode.c:205
#4 0x55bcae0d587c in drw_engines_cache_populate /home/mark/storage/code/blender/source/blender/draw/intern/draw_manager.c:844
#5 0x55bcae0d974c in DRW_draw_render_loop_ex /home/mark/storage/code/blender/source/blender/draw/intern/draw_manager.c:1298
#6 0x55bcae0d8c28 in DRW_draw_view /home/mark/storage/code/blender/source/blender/draw/intern/draw_manager.c:1237
#7 0x55bcab443f0b in view3d_draw_view /home/mark/storage/code/blender/source/blender/editors/space_view3d/view3d_draw.c:1249
#8 0x55bcab44409c in view3d_main_region_draw /home/mark/storage/code/blender/source/blender/editors/space_view3d/view3d_draw.c:1269
#9 0x55bcac72f40b in ED_region_do_draw /home/mark/storage/code/blender/source/blender/editors/screen/area.c:472
#10 0x55bcaaf0a5a7 in wm_draw_window_offscreen /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_draw.c:536
#11 0x55bcaaf0b87f in wm_draw_window /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_draw.c:662
#12 0x55bcaaf0c999 in wm_draw_update /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_draw.c:816
#13 0x55bcaaef1b26 in WM_main /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm.c:551
#14 0x55bcaaee1a24 in main /home/mark/storage/code/blender/source/creator/creator.c:516
#15 0x7ff69719b06a in __libc_start_main (/usr/lib/libc.so.6+0x2306a)
#16 0x55bcaaee0a19 in _start (/mnt/storage/mark/code/build_linux_asan/bin/blender+0x1f8f2a19)
0x6110005aa2c8 is located 8 bytes inside of 240-byte region [0x6110005aa2c0,0x6110005aa3b0)
freed by thread T0 here:
#0 0x7ff69ce659b1 in __interceptor_free /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:66
#1 0x55bcb0bf94bb in MEM_lockfree_freeN /home/mark/storage/code/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:164
#2 0x55bcaf158b88 in BKE_pbvh_free /home/mark/storage/code/blender/source/blender/blenkernel/intern/pbvh.c:666
#3 0x55bcac9a4295 in sculpt_pbvh_clear /home/mark/storage/code/blender/source/blender/editors/sculpt_paint/sculpt.c:5222
#4 0x55bcac9a5b6e in sculpt_dynamic_topology_enable_ex /home/mark/storage/code/blender/source/blender/editors/sculpt_paint/sculpt.c:5284
#5 0x55bcac9a7abf in sculpt_dynamic_topology_enable_with_undo /home/mark/storage/code/blender/source/blender/editors/sculpt_paint/sculpt.c:5404
#6 0x55bcac9a7c36 in sculpt_dynamic_topology_toggle_exec /home/mark/storage/code/blender/source/blender/editors/sculpt_paint/sculpt.c:5423
#7 0x55bcac9a86c2 in sculpt_dynamic_topology_toggle_invoke /home/mark/storage/code/blender/source/blender/editors/sculpt_paint/sculpt.c:5525
#8 0x55bcaaf1bd05 in wm_operator_invoke /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:1275
#9 0x55bcaaf1dda6 in wm_operator_call_internal /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:1470
#10 0x55bcaaf1e081 in WM_operator_name_call_ptr /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:1518
#11 0x55bcabdb797a in ui_apply_but_funcs_after /home/mark/storage/code/blender/source/blender/editors/interface/interface_handlers.c:816
#12 0x55bcabe3cfc7 in ui_handler_region_menu /home/mark/storage/code/blender/source/blender/editors/interface/interface_handlers.c:10193
#13 0x55bcaaf125e9 in wm_handler_ui_call /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:544
#14 0x55bcaaf272b3 in wm_handlers_do_intern /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:2301
#15 0x55bcaaf29088 in wm_handlers_do /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:2523
#16 0x55bcaaf2c97f in wm_event_do_handlers /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:2816
#17 0x55bcaaef1b0e in WM_main /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm.c:545
#18 0x55bcaaee1a24 in main /home/mark/storage/code/blender/source/creator/creator.c:516
#19 0x7ff69719b06a in __libc_start_main (/usr/lib/libc.so.6+0x2306a)
previously allocated by thread T35 here:
#0 0x7ff69ce65fc1 in __interceptor_calloc /build/gcc/src/gcc/libsanitizer/asan/asan_malloc_linux.cc:95
#1 0x55bcb0bf9c07 in MEM_lockfree_callocN /home/mark/storage/code/blender/intern/guardedalloc/intern/mallocn_lockfree_impl.c:282
#2 0x55bcaf158042 in BKE_pbvh_new /home/mark/storage/code/blender/source/blender/blenkernel/intern/pbvh.c:618
#3 0x55bcae9d39da in cdDM_getPBVH /home/mark/storage/code/blender/source/blender/blenkernel/intern/cdderivedmesh.c:302
#4 0x55bcaf076777 in BKE_sculpt_update_mesh_elements /home/mark/storage/code/blender/source/blender/blenkernel/intern/paint.c:933
#5 0x55bcae8ea997 in mesh_build_data /home/mark/storage/code/blender/source/blender/blenkernel/intern/DerivedMesh.c:3017
#6 0x55bcae8eb753 in makeDerivedMesh /home/mark/storage/code/blender/source/blender/blenkernel/intern/DerivedMesh.c:3101
#7 0x55bcaf05db80 in BKE_object_handle_data_update /home/mark/storage/code/blender/source/blender/blenkernel/intern/object_update.c:202
#8 0x55bcaf05f88e in BKE_object_eval_uber_data /home/mark/storage/code/blender/source/blender/blenkernel/intern/object_update.c:321
#9 0x55bcb024248e in void std::__invoke_impl<void, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(std::__invoke_other, void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/8.1.0/bits/invoke.h:60
#10 0x55bcb023e1e4 in std::__invoke_result<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>::type std::__invoke<void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*, Scene*&, Object*&>(void (*&)(Depsgraph*, Scene*, Object*), Depsgraph*&&, Scene*&, Object*&) /usr/include/c++/8.1.0/bits/invoke.h:95
#11 0x55bcb0238f47 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::__call<void, Depsgraph*&&, 0ul, 1ul, 2ul>(std::tuple<Depsgraph*&&>&&, std::_Index_tuple<0ul, 1ul, 2ul>) /usr/include/c++/8.1.0/functional:400
#12 0x55bcb0231cb8 in void std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)>::operator()<Depsgraph*, void>(Depsgraph*&&) /usr/include/c++/8.1.0/functional:484
#13 0x55bcb02287ca in std::_Function_handler<void (Depsgraph*), std::_Bind<void (*(std::_Placeholder<1>, Scene*, Object*))(Depsgraph*, Scene*, Object*)> >::_M_invoke(std::_Any_data const&, Depsgraph*&&) /usr/include/c++/8.1.0/bits/std_function.h:297
#14 0x55bcb0286ed8 in std::function<void (Depsgraph*)>::operator()(Depsgraph*) const /usr/include/c++/8.1.0/bits/std_function.h:687
#15 0x55bcb0283e24 in deg_task_run_func /home/mark/storage/code/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:94
#16 0x55bcb016f72c in handle_local_queue /home/mark/storage/code/blender/source/blender/blenlib/intern/task.c:419
#17 0x55bcb016f72c in task_scheduler_thread_run /home/mark/storage/code/blender/source/blender/blenlib/intern/task.c:448
#18 0x7ff69773f074 in start_thread (/usr/lib/libpthread.so.0+0x7074)
Thread T35 created by T0 here:
#0 0x7ff69cdbfa51 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cc:202
#1 0x55bcb017027a in BLI_task_scheduler_create /home/mark/storage/code/blender/source/blender/blenlib/intern/task.c:504
#2 0x55bcb017c43f in BLI_task_scheduler_get /home/mark/storage/code/blender/source/blender/blenlib/intern/threads.c:176
#3 0x55bcb017a30b in BLI_task_parallel_range /home/mark/storage/code/blender/source/blender/blenlib/intern/task.c:1099
#4 0x55bcb0292aa2 in flush_prepare /home/mark/storage/code/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:105
#5 0x55bcb0292aa2 in DEG::deg_graph_flush_updates(Main*, DEG::Depsgraph*) /home/mark/storage/code/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:273
#6 0x55bcb0202e6b in DEG_graph_flush_update /home/mark/storage/code/blender/source/blender/depsgraph/intern/depsgraph_tag.cc:637
#7 0x55bcaf2170ac in BKE_scene_graph_update_tagged /home/mark/storage/code/blender/source/blender/blenkernel/intern/scene.c:1366
#8 0x55bcaf484c45 in BKE_workspace_update_tagged /home/mark/storage/code/blender/source/blender/blenkernel/intern/workspace.c:515
#9 0x55bcaaf0fded in wm_event_do_refresh_wm_and_depsgraph /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm_event_system.c:343
#10 0x55bcaaef1af6 in WM_main /home/mark/storage/code/blender/source/blender/windowmanager/intern/wm.c:537
#11 0x55bcaaee1a24 in main /home/mark/storage/code/blender/source/creator/creator.c:516
#12 0x7ff69719b06a in __libc_start_main (/usr/lib/libc.so.6+0x2306a)
SUMMARY: AddressSanitizer: heap-use-after-free /home/mark/storage/code/blender/source/blender/blenkernel/intern/pbvh.c:2352 in pbvh_has_mask
Shadow bytes around the buggy address:
0x0c22800ad400: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c22800ad410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c22800ad420: 00 fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c22800ad430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c22800ad440: 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa
=>0x0c22800ad450: fa fa fa fa fa fa fa fa fd[fd]fd fd fd fd fd fd
0x0c22800ad460: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c22800ad470: fd fd fd fd fd fd fa fa fa fa fa fa fa fa fa fa
0x0c22800ad480: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c22800ad490: fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa
0x0c22800ad4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==23579==ABORTING
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.