==873214==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00016fb78 at pc 0x0000020d0002 bp 0x7fffffffc220 sp 0x7fffffffc210 READ of size 4 at 0x60c00016fb78 thread T0 #0 0x20d0001 in BKE_nlastrips_make_metas blender/source/blender/blenkernel/intern/nla.c:816 #1 0x804c364 in createTransNlaData blender/source/blender/editors/transform/transform_convert_nla.c:103 #2 0x7f7cc67 in createTransData blender/source/blender/editors/transform/transform_convert.c:1444 #3 0x7f57282 in initTransform blender/source/blender/editors/transform/transform.c:1812 #4 0x8195248 in transformops_data blender/source/blender/editors/transform/transform_ops.c:383 #5 0x8195df2 in transform_invoke blender/source/blender/editors/transform/transform_ops.c:499 #6 0x3675db5 in wm_operator_invoke blender/source/blender/windowmanager/intern/wm_event_system.cc:1389 #7 0x36802af in wm_handler_operator_call blender/source/blender/windowmanager/intern/wm_event_system.cc:2425 #8 0x36845b4 in wm_handlers_do_keymap_with_keymap_handler blender/source/blender/windowmanager/intern/wm_event_system.cc:2817 #9 0x3687828 in wm_handlers_do_intern blender/source/blender/windowmanager/intern/wm_event_system.cc:3143 #10 0x3688b0f in wm_handlers_do blender/source/blender/windowmanager/intern/wm_event_system.cc:3283 #11 0x368e822 in wm_event_do_region_handlers blender/source/blender/windowmanager/intern/wm_event_system.cc:3702 #12 0x368ea07 in wm_event_do_handlers_area_regions blender/source/blender/windowmanager/intern/wm_event_system.cc:3732 #13 0x3691302 in wm_event_do_handlers blender/source/blender/windowmanager/intern/wm_event_system.cc:3929 #14 0x364f681 in WM_main blender/source/blender/windowmanager/intern/wm.c:623 #15 0x1bc8d3b in main blender/source/creator/creator.c:547 #16 0x7ffff6db1082 in __libc_start_main ../csu/libc-start.c:308 #17 0x1bc810d in _start (build_debug/bin/blender+0x1bc810d) 0x60c00016fb78 is located 56 bytes inside of 128-byte region [0x60c00016fb40,0x60c00016fbc0) freed by thread T0 here: #0 0x7ffff766e40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0xd9a7a9d in rem_memblock blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:1003 #2 0xd9a6a54 in MEM_guarded_freeN blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:892 #3 0xd635c3b in BLI_freelistN blender/source/blender/blenlib/intern/listbase.c:473 #4 0x1ed4344 in layer_collection_free blender/source/blender/blenkernel/intern/layer.c:90 #5 0x1ed5a79 in BKE_view_layer_free_ex blender/source/blender/blenkernel/intern/layer.c:254 #6 0x2435562 in scene_free_data blender/source/blender/blenkernel/intern/scene.cc:403 #7 0x1f04f19 in BKE_libblock_free_datablock blender/source/blender/blenkernel/intern/lib_id_delete.c:72 #8 0x418f6f3 in blender::deg::deg_free_copy_on_write_datablock(ID*) blender/source/blender/depsgraph/intern/eval/deg_eval_copy_on_write.cc:1022 #9 0x418ede7 in blender::deg::deg_update_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) blender/source/blender/depsgraph/intern/eval/deg_eval_copy_on_write.cc:901 #10 0x4184778 in depsgraph_ensure_view_layer blender/source/blender/depsgraph/intern/eval/deg_eval.cc:334 #11 0x4184a77 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) blender/source/blender/depsgraph/intern/eval/deg_eval.cc:363 #12 0x4093820 in deg_flush_updates_and_refresh blender/source/blender/depsgraph/intern/depsgraph_eval.cc:44 #13 0x4093d43 in DEG_evaluate_on_framechange blender/source/blender/depsgraph/intern/depsgraph_eval.cc:79 #14 0x2457293 in BKE_scene_graph_update_for_newframe_ex blender/source/blender/blenkernel/intern/scene.cc:2676 #15 0x24573b7 in BKE_scene_graph_update_for_newframe blender/source/blender/blenkernel/intern/scene.cc:2724 #16 0x5a61fab in ED_update_for_newframe blender/source/blender/editors/screen/screen_edit.c:1712 #17 0x366d35a in wm_event_do_notifiers blender/source/blender/windowmanager/intern/wm_event_system.cc:562 #18 0x364f68d in WM_main blender/source/blender/windowmanager/intern/wm.c:626 #19 0x1bc8d3b in main blender/source/creator/creator.c:547 #20 0x7ffff6db1082 in __libc_start_main ../csu/libc-start.c:308 previously allocated by thread T0 here: #0 0x7ffff766e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0xd9a4436 in MEM_guarded_mallocN blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:438 #2 0xd9a31fd in MEM_guarded_dupallocN blender/intern/guardedalloc/intern/mallocn_guarded_impl.c:251 #3 0xd637a50 in BLI_duplicatelist blender/source/blender/blenlib/intern/listbase.c:790 #4 0x1ed7e54 in layer_collections_copy_data blender/source/blender/blenkernel/intern/layer.c:461 #5 0x1ed7f76 in layer_collections_copy_data blender/source/blender/blenkernel/intern/layer.c:467 #6 0x1ed8a06 in BKE_view_layer_copy_data blender/source/blender/blenkernel/intern/layer.c:512 #7 0x2432fa4 in scene_copy_data blender/source/blender/blenkernel/intern/scene.cc:261 #8 0x1ef4215 in BKE_id_copy_ex blender/source/blender/blenkernel/intern/lib_id.c:630 #9 0x418a640 in scene_copy_inplace_no_main blender/source/blender/depsgraph/intern/eval/deg_eval_copy_on_write.cc:320 #10 0x418e478 in deg_expand_copy_on_write_datablock blender/source/blender/depsgraph/intern/eval/deg_eval_copy_on_write.cc:810 #11 0x418ee00 in blender::deg::deg_update_copy_on_write_datablock(blender::deg::Depsgraph const*, blender::deg::IDNode const*) blender/source/blender/depsgraph/intern/eval/deg_eval_copy_on_write.cc:902 #12 0x4184778 in depsgraph_ensure_view_layer blender/source/blender/depsgraph/intern/eval/deg_eval.cc:334 #13 0x4184a77 in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) blender/source/blender/depsgraph/intern/eval/deg_eval.cc:363 #14 0x4093820 in deg_flush_updates_and_refresh blender/source/blender/depsgraph/intern/depsgraph_eval.cc:44 #15 0x4093d43 in DEG_evaluate_on_framechange blender/source/blender/depsgraph/intern/depsgraph_eval.cc:79 #16 0x2457293 in BKE_scene_graph_update_for_newframe_ex blender/source/blender/blenkernel/intern/scene.cc:2676 #17 0x24573b7 in BKE_scene_graph_update_for_newframe blender/source/blender/blenkernel/intern/scene.cc:2724 #18 0x5a61fab in ED_update_for_newframe blender/source/blender/editors/screen/screen_edit.c:1712 #19 0x366d35a in wm_event_do_notifiers blender/source/blender/windowmanager/intern/wm_event_system.cc:562 #20 0x364f68d in WM_main blender/source/blender/windowmanager/intern/wm.c:626 #21 0x1bc8d3b in main blender/source/creator/creator.c:547 #22 0x7ffff6db1082 in __libc_start_main ../csu/libc-start.c:308 SUMMARY: AddressSanitizer: heap-use-after-free blender/source/blender/blenkernel/intern/nla.c:816 in BKE_nlastrips_make_metas Shadow bytes around the buggy address: 0x0c1880025f10: 00 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa 0x0c1880025f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa 0x0c1880025f30: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1880025f40: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 0x0c1880025f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa =>0x0c1880025f60: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd[fd] 0x0c1880025f70: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c1880025f80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c1880025f90: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c1880025fa0: 00 00 00 00 00 00 04 fa fa fa fa fa fa fa fa fa 0x0c1880025fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==873214==ABORTING [1] + Done "/usr/bin/gdb" --interpreter=mi --tty=${DbgTerm} 0<"/tmp/Microsoft-MIEngine-In-5zlz3kle.wqj" 1>"/tmp/Microsoft-MIEngine-Out-zfnf3f2z.1qo" sybren@ws-sybren ~/w/b/blender (master)>