Maniphest T93797

Crash [or faulty eevee render] when opening UDIM_monster
Closed, Resolved
Actions

Assigned To
Julian Eisel (Severin)
Authored By
Jeroen Bakker (jbakker)
Dec 7 2021, 10:05 AM
Tags
  • BF Blender
  • EEVEE & Viewport
Subscribers
Aaron Carlisle (Blendify)
Jeroen Bakker (jbakker)
Jesse Yurkovich (deadpin)
Philipp Oeser (lichtwerk)

Description

System Information
Operating system: Linux-5.13.0-7620-generic-x86_64-with-glibc2.33 64 Bits
Graphics card: Radeon RX Vega (VEGA10, DRM 3.41.0, 5.13.0-7620-generic, LLVM 12.0.0) AMD 4.6 (Core Profile) Mesa 21.2.2

Blender Version
Broken: version: 3.1.0 Alpha, branch: master, commit date: 2021-12-07 07:55, hash: rB1de363662427
Worked: before rBd5efda72f501: Cleanup: Migrate all shader nodes to c++

The crash is that during preview rendering NTscales where the second node refers to uninitialized memory. (0xffffffffff). node_shader_tree.cc#localize

# Blender 3.1.0, Commit date: 2021-12-07 07:55, Hash 1de363662427

# backtrace
/home/jeroen/blender-git/build_linux/bin/blender(BLI_system_backtrace+0x39) [0x108dfc07]
/home/jeroen/blender-git/build_linux/bin/blender() [0x3a6cfa3]
/home/jeroen/blender-git/build_linux/bin/blender() [0x3a6d1cb]
/lib/x86_64-linux-gnu/libc.so.6(+0x41040) [0x7ffff7a8c040]
/home/jeroen/blender-git/build_linux/bin/blender() [0x6959dc7]
/home/jeroen/blender-git/build_linux/bin/blender(ntreeLocalize+0x151) [0x3b5efcf]
/home/jeroen/blender-git/build_linux/bin/blender(ntreeLocalize+0xa8) [0x3b5ef26]
/home/jeroen/blender-git/build_linux/bin/blender() [0x3b0b789]
/home/jeroen/blender-git/build_linux/bin/blender(BKE_id_copy_ex+0x112) [0x3ae894c]
/home/jeroen/blender-git/build_linux/bin/blender() [0x6a083c1]
/home/jeroen/blender-git/build_linux/bin/blender(ED_preview_icon_job+0x13e) [0x6a0c46e]
/home/jeroen/blender-git/build_linux/bin/blender() [0x55272f3]
/home/jeroen/blender-git/build_linux/bin/blender() [0x5528c76]
/home/jeroen/blender-git/build_linux/bin/blender(UI_icon_render_id+0xb0) [0x5528d52]
/home/jeroen/blender-git/build_linux/bin/blender(ui_id_icon_get+0xf0) [0x55292eb]
/home/jeroen/blender-git/build_linux/bin/blender(UI_icon_from_rnaptr+0x228) [0x55295e5]
/home/jeroen/blender-git/build_linux/bin/blender() [0x555e069]
/home/jeroen/blender-git/build_linux/bin/blender(uiTemplateList_ex+0x335) [0x555f7e6]
/home/jeroen/blender-git/build_linux/bin/blender(uiTemplateList+0x67) [0x555f881]
/home/jeroen/blender-git/build_linux/bin/blender(rna_uiTemplateList+0x88) [0x4b75373]
/home/jeroen/blender-git/build_linux/bin/blender(UILayout_template_list_call+0x13a) [0x4b7bcca]
/home/jeroen/blender-git/build_linux/bin/blender(RNA_function_call+0x4b) [0x49566f4]
/home/jeroen/blender-git/build_linux/bin/blender() [0x4c18ecf]
/home/jeroen/blender-git/build_linux/bin/blender(_PyObject_MakeTpCall+0x90) [0xf2fce20]
/home/jeroen/blender-git/build_linux/bin/blender(_PyEval_EvalFrameDefault+0x625c) [0x3a64ebc]
/home/jeroen/blender-git/build_linux/bin/blender() [0x3a5dcfb]
/home/jeroen/blender-git/build_linux/bin/blender(PyVectorcall_Call+0x5f) [0xf2fc87f]
/home/jeroen/blender-git/build_linux/bin/blender() [0x4c1c07b]
/home/jeroen/blender-git/build_linux/bin/blender() [0x4b711d7]
/home/jeroen/blender-git/build_linux/bin/blender() [0x4c4d182]
/home/jeroen/blender-git/build_linux/bin/blender(ED_region_panels_layout_ex+0x4d1) [0x4c4db51]
/home/jeroen/blender-git/build_linux/bin/blender() [0xe44bf51]
/home/jeroen/blender-git/build_linux/bin/blender() [0xe44caef]
/home/jeroen/blender-git/build_linux/bin/blender(ED_region_do_layout+0xcb) [0x4c462f7]
/home/jeroen/blender-git/build_linux/bin/blender() [0x41900ad]
/home/jeroen/blender-git/build_linux/bin/blender() [0x41908d0]
/home/jeroen/blender-git/build_linux/bin/blender(wm_draw_update+0xc9) [0x4190f1c]
/home/jeroen/blender-git/build_linux/bin/blender(WM_main+0x4c) [0x418c615]
/home/jeroen/blender-git/build_linux/bin/blender() [0x3a685d0]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xd5) [0x7ffff7a73565]
/home/jeroen/blender-git/build_linux/bin/blender(_start+0x2e) [0x3a67fbe]

# Python backtrace
  File "/home/jeroen/blender-git/build_linux/bin/3.1/scripts/startup/bl_ui/properties_material.py", line 117 in draw

Short description of error
When opening UDIM_monster from the command line blender crashes.

Exact steps for others to reproduce the error

  • Download and extract UDIM_monster.zip from the demo files
  • Open the file in blender and see it works.
  • Quit blender
  • Start Blender with --open-last option and it crashes.

Additional: seems to crash now always.... even release builds.

system-info.txt12 KBDownload

Revisions and Commits

rB Blender
rBae5a89e80af7 Fix T93797, T93809: Crash/undefined-behavior when opening demo file

Related Objects

Event Timeline

Jeroen Bakker (jbakker) created this task.Dec 7 2021, 10:05 AM
Jeroen Bakker (jbakker) renamed this task from Crash when opening file from command line. to Crash when opening UDIM_monster.Dec 7 2021, 10:24 AM
Jeroen Bakker (jbakker) updated the task description.
Jeroen Bakker (jbakker) updated the task description.
Philipp Oeser (lichtwerk) added a subscriber: Philipp Oeser (lichtwerk).Dec 7 2021, 10:35 AM

Hm, seems like I cannot repro here

**System Information**
Operating system: Linux-5.13.0-0.rc6.45.fc35.x86_64-x86_64-with-glibc2.34.9000 64 Bits
Graphics card: NVIDIA GeForce GTX 970M/PCIe/SSE2 NVIDIA Corporation 4.5.0 NVIDIA 495.44
version: 3.1.0 Alpha, branch: master, commit date: 2021-12-07 06:38, hash: `rBffc4c126f541`
Jesse Yurkovich (deadpin) added a subscriber: Jesse Yurkovich (deadpin).Dec 7 2021, 10:48 AM

Here's the ASAN report and it more or less matches the initial stack above:

udim-crash.txt12 KBDownload

Philipp Oeser (lichtwerk) changed the task status from Needs Triage to Confirmed.EditedDec 7 2021, 11:01 AM
Philipp Oeser (lichtwerk) triaged this task as High priority.
Philipp Oeser (lichtwerk) added projects: EEVEE & Viewport, Nodes.
Philipp Oeser (lichtwerk) added a subscriber: Aaron Carlisle (Blendify).

What I do see though that the monster renders differently in Eevee (and for that, that file can be opened "normally", meaning you dont have to do the dance with --open-last), Cycles is fine though:
before rBd5efda72f501


after rBd5efda72f501

CC @Aaron Carlisle (Blendify)

Philipp Oeser (lichtwerk) renamed this task from Crash when opening UDIM_monster to Crash [or fauly eevee render] when opening UDIM_monster.Dec 7 2021, 11:02 AM
Philipp Oeser (lichtwerk) renamed this task from Crash [or fauly eevee render] when opening UDIM_monster to Crash [or faulty eevee render] when opening UDIM_monster.
Philipp Oeser (lichtwerk) mentioned this in T93798: Eevee: Group node shaders do not get compiled when using Mix Shader node.Dec 7 2021, 11:11 AM
Jesse Yurkovich (deadpin) added a comment.Dec 7 2021, 11:33 AM

The code in localize was changed. Fixing that will fix the crash, but the result is still broken and looks like Philipp's above. Haven't been able to find out the reason though.

Before

bNode *node, *node_next;

/* replace muted nodes and reroute nodes by internal links */
for (node = localtree->nodes.first; node; node = node_next) {
  node_next = node->next;

  if (node->flag & NODE_MUTED || node->type == NODE_REROUTE) {
    nodeInternalRelink(localtree, node);
    ntreeFreeLocalNode(localtree, node);
  }
}

After -- missed saving the node_next manually since node get destroyed inside the conditional there

/* replace muted nodes and reroute nodes by internal links */
LISTBASE_FOREACH (bNode *, node, &localtree->nodes) {
  if (node->flag & NODE_MUTED || node->type == NODE_REROUTE) {
    nodeInternalRelink(localtree, node);
    ntreeFreeLocalNode(localtree, node);
  }
}
Jesse Yurkovich (deadpin) mentioned this in T93809: Crash/undefined-behavior when opening demo file (heap-use-after-free of material node-tree in Eevee).Dec 7 2021, 11:55 AM
Julian Eisel (Severin) closed this task as Resolved by committing rBae5a89e80af7: Fix T93797, T93809: Crash/undefined-behavior when opening demo file.Dec 7 2021, 12:03 PM
Julian Eisel (Severin) claimed this task.
Julian Eisel (Severin) added a commit: rBae5a89e80af7: Fix T93797, T93809: Crash/undefined-behavior when opening demo file.
Julian Eisel (Severin) added a comment.Dec 7 2021, 12:05 PM

Thanks guys for the analysis, with that it was trivial to fix the crash/undefined-behavior. There are still the differences in rendering, but this is better handled as a separate issue.

Julian Eisel (Severin) added a comment.EditedDec 7 2021, 12:07 PM

For the record, the Cube Diorama demo file is also broken now. This is how it looks currently:

This is how it should look (older 3.0 build, so ignore other differences):

Are we sure that this issue also comes from the same commit?

Jesse Yurkovich (deadpin) added a comment.Dec 7 2021, 12:23 PM

There's at least one more "mutable" iterator that needs fixup from that same commit, so I'd say so :)
Line ~465 of node_shader_tree.cc

Fixing that one gets this bug, T93798, and the diorama fixed up.

Philipp Oeser (lichtwerk) added a comment.Dec 7 2021, 12:31 PM

Are we sure that this issue also comes from the same commit?

yes

There are still the differences in rendering, but this is better handled as a separate issue.

If we close something like this, can we please make sure to have another report open for the remaining issue(s)?

In the end, this might boild down to T93798: Eevee: Group node shaders do not get compiled when using Mix Shader node, just saying we risk something slipping through this way...

@Jesse Yurkovich (deadpin) : great, could you post a diff or something in T93798 then?

Julian Eisel (Severin) added a comment.EditedDec 7 2021, 12:35 PM

If we close something like this, can we please make sure to have another report open for the remaining issue(s)?

Yes we were actively looking at it and discussing the situation (in person in the Studio & in #blender-coders). Decision is to revert the commit and let it go through a proper review first (to catch these errors and address other C++ code style problems).

Julian Eisel (Severin) mentioned this in D13498: Fix: Revert moving shader nodes to C++..Dec 7 2021, 12:54 PM
Jacques Lucke (JacquesLucke) mentioned this in rB0f48b37aae02: Revert moving all shader nodes to c++.Dec 7 2021, 1:28 PM
Hans Goudey (HooglyBoogly) removed a project: Nodes.May 16 2022, 11:01 AM