==177134==ERROR: AddressSanitizer: heap-use-after-free on address 0x612000a4fbc0 at pc 0x000025051b30 bp 0x7fff99d241c0 sp 0x7fff99d241b0 READ of size 8 at 0x612000a4fbc0 thread T84 #0 0x25051b2f in ccl::BVHEmbree::build(ccl::Progress&, ccl::Stats*, RTCDeviceTy*) /home/jacques/blender-git/blender/intern/cycles/bvh/bvh_embree.cpp:349 #1 0x252401e4 in ccl::CPUDevice::build_bvh(ccl::BVH*, ccl::Progress&, bool) /home/jacques/blender-git/blender/intern/cycles/device/device_cpu.cpp:562 #2 0x27ed64ae in ccl::GeometryManager::device_update_bvh(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/jacques/blender-git/blender/intern/cycles/render/geometry.cpp:1241 #3 0x27ef9c84 in ccl::GeometryManager::device_update(ccl::Device*, ccl::DeviceScene*, ccl::Scene*, ccl::Progress&) /home/jacques/blender-git/blender/intern/cycles/render/geometry.cpp:1961 #4 0x2859bfa3 in ccl::Scene::device_update(ccl::Device*, ccl::Progress&) /home/jacques/blender-git/blender/intern/cycles/render/scene.cpp:282 #5 0x285aea75 in ccl::Scene::update(ccl::Progress&, bool&) /home/jacques/blender-git/blender/intern/cycles/render/scene.cpp:524 #6 0x28614443 in ccl::Session::update_scene() /home/jacques/blender-git/blender/intern/cycles/render/session.cpp:1047 #7 0x2860c1e1 in ccl::Session::run_cpu() /home/jacques/blender-git/blender/intern/cycles/render/session.cpp:813 #8 0x2860fe93 in ccl::Session::run() /home/jacques/blender-git/blender/intern/cycles/render/session.cpp:895 #9 0x2863fc78 in void std::__invoke_impl(std::__invoke_memfun_deref, void (ccl::Session::*&)(), ccl::Session*&) /usr/include/c++/10.2.0/bits/invoke.h:73 #10 0x2863d2c3 in std::__invoke_result::type std::__invoke(void (ccl::Session::*&)(), ccl::Session*&) /usr/include/c++/10.2.0/bits/invoke.h:95 #11 0x2863bb3a in void std::_Bind::__call(std::tuple<>&&, std::_Index_tuple<0ul>) /usr/include/c++/10.2.0/functional:416 #12 0x28638e4c in void std::_Bind::operator()<, void>() /usr/include/c++/10.2.0/functional:499 #13 0x28635505 in void std::__invoke_impl&>(std::__invoke_other, std::_Bind&) /usr/include/c++/10.2.0/bits/invoke.h:60 #14 0x28632258 in std::enable_if&>, void>::type std::__invoke_r&>(std::_Bind&) /usr/include/c++/10.2.0/bits/invoke.h:110 #15 0x2862dd2c in std::_Function_handler >::_M_invoke(std::_Any_data const&) /usr/include/c++/10.2.0/bits/std_function.h:291 #16 0x1752bd5d in std::function::operator()() const /usr/include/c++/10.2.0/bits/std_function.h:622 #17 0x2cb33af6 in ccl::thread::run(void*) /home/jacques/blender-git/blender/intern/cycles/util/util_thread.cpp:52 #18 0x2cb35a3b in void* std::__invoke_impl(std::__invoke_other, void* (*&&)(void*), ccl::thread*&&) /usr/include/c++/10.2.0/bits/invoke.h:60 #19 0x2cb356bb in std::__invoke_result::type std::__invoke(void* (*&&)(void*), ccl::thread*&&) /usr/include/c++/10.2.0/bits/invoke.h:95 #20 0x2cb353e4 in void* std::thread::_Invoker >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) /usr/include/c++/10.2.0/thread:264 #21 0x2cb351f1 in std::thread::_Invoker >::operator()() /usr/include/c++/10.2.0/thread:271 #22 0x2cb35187 in std::thread::_State_impl > >::_M_run() /usr/include/c++/10.2.0/thread:215 #23 0x329c3213 in execute_native_thread_routine (/home/jacques/blender-git/build_linux/bin/blender+0x329c3213) #24 0x7ffff758e3e8 in start_thread (/usr/lib/libpthread.so.0+0x93e8) #25 0x7ffff7153292 in __GI___clone (/usr/lib/libc.so.6+0x100292) 0x612000a4fbc0 is located 0 bytes inside of 288-byte region [0x612000a4fbc0,0x612000a4fce0) freed by thread T0 here: #0 0x7ffff7661009 in operator delete(void*, unsigned long) /build/gcc/src/gcc/libsanitizer/asan/asan_new_delete.cpp:172 #1 0x284af1e2 in ccl::Object::~Object() /home/jacques/blender-git/blender/intern/cycles/render/object.cpp:117 #2 0x285d3c9a in void ccl::delete_node_from_array(ccl::vector >&, ccl::Object*) /home/jacques/blender-git/blender/intern/cycles/render/scene.cpp:698 #3 0x285b8fda in void ccl::Scene::delete_node_impl(ccl::Object*) /home/jacques/blender-git/blender/intern/cycles/render/scene.cpp:741 #4 0x24c8b723 in void ccl::Scene::delete_node(ccl::Object*) /home/jacques/blender-git/blender/intern/cycles/render/scene.h:320 #5 0x24c817cd in ccl::id_map::post_sync(bool) /home/jacques/blender-git/blender/intern/cycles/blender/blender_id_map.h:170 #6 0x24c649e3 in ccl::BlenderSync::sync_objects(BL::Depsgraph&, BL::SpaceView3D&, float) /home/jacques/blender-git/blender/intern/cycles/blender/blender_object.cpp:566 #7 0x24bda8e8 in ccl::BlenderSync::sync_data(BL::RenderSettings&, BL::Depsgraph&, BL::SpaceView3D&, BL::Object&, int, int, void**) /home/jacques/blender-git/blender/intern/cycles/blender/blender_sync.cpp:242 #8 0x24b1873b in ccl::BlenderSession::synchronize(BL::Depsgraph&) /home/jacques/blender-git/blender/intern/cycles/blender/blender_session.cpp:816 #9 0x24aa8176 in sync_func /home/jacques/blender-git/blender/intern/cycles/blender/blender_python.cpp:398 #10 0x30961e38 in _PyMethodDef_RawFastCallKeywords Objects/call.c:698 previously allocated by thread T0 here: #0 0x7ffff765ff41 in operator new(unsigned long) /build/gcc/src/gcc/libsanitizer/asan/asan_new_delete.cpp:99 #1 0x285b6d39 in ccl::Object* ccl::Scene::create_node() /home/jacques/blender-git/blender/intern/cycles/render/scene.cpp:649 #2 0x24c7bf0a in ccl::id_map::add_or_update(ccl::Object**, BL::ID const&, BL::ID const&, ccl::ObjectKey const&) /home/jacques/blender-git/blender/intern/cycles/blender/blender_id_map.h:128 #3 0x24c58910 in ccl::BlenderSync::sync_object(BL::Depsgraph&, BL::ViewLayer&, BL::DepsgraphObjectInstance&, float, bool, bool, ccl::BlenderObjectCulling&, bool*, ccl::TaskPool*) /home/jacques/blender-git/blender/intern/cycles/blender/blender_object.cpp:224 #4 0x24c64013 in ccl::BlenderSync::sync_objects(BL::Depsgraph&, BL::SpaceView3D&, float) /home/jacques/blender-git/blender/intern/cycles/blender/blender_object.cpp:529 #5 0x24bda8e8 in ccl::BlenderSync::sync_data(BL::RenderSettings&, BL::Depsgraph&, BL::SpaceView3D&, BL::Object&, int, int, void**) /home/jacques/blender-git/blender/intern/cycles/blender/blender_sync.cpp:242 #6 0x24b1873b in ccl::BlenderSession::synchronize(BL::Depsgraph&) /home/jacques/blender-git/blender/intern/cycles/blender/blender_session.cpp:816 #7 0x24aa8176 in sync_func /home/jacques/blender-git/blender/intern/cycles/blender/blender_python.cpp:398 #8 0x30961e38 in _PyMethodDef_RawFastCallKeywords Objects/call.c:698 Thread T84 created by T0 here: #0 0x7ffff76041c7 in __interceptor_pthread_create /build/gcc/src/gcc/libsanitizer/asan/asan_interceptors.cpp:214 #1 0x329c32f9 in std::thread::_M_start_thread(std::unique_ptr >, void (*)()) (/home/jacques/blender-git/build_linux/bin/blender+0x329c32f9) #2 0x2cb333c9 in ccl::thread::thread(std::function, int) /home/jacques/blender-git/blender/intern/cycles/util/util_thread.cpp:35 #3 0x285f4184 in ccl::Session::start() /home/jacques/blender-git/blender/intern/cycles/render/session.cpp:131 #4 0x24b1a2bd in ccl::BlenderSession::synchronize(BL::Depsgraph&) /home/jacques/blender-git/blender/intern/cycles/blender/blender_session.cpp:853 #5 0x24aa8176 in sync_func /home/jacques/blender-git/blender/intern/cycles/blender/blender_python.cpp:398 #6 0x30961e38 in _PyMethodDef_RawFastCallKeywords Objects/call.c:698 SUMMARY: AddressSanitizer: heap-use-after-free /home/jacques/blender-git/blender/intern/cycles/bvh/bvh_embree.cpp:349 in ccl::BVHEmbree::build(ccl::Progress&, ccl::Stats*, RTCDeviceTy*) Shadow bytes around the buggy address: 0x0c2480141f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2480141f30: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 0x0c2480141f40: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c2480141f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2480141f60: 00 00 00 00 00 00 00 00 00 00 00 00 fa fa fa fa =>0x0c2480141f70: fa fa fa fa fa fa fa fa[fd]fd fd fd fd fd fd fd 0x0c2480141f80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2480141f90: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa 0x0c2480141fa0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c2480141fb0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c2480141fc0: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==177134==ABORTING