==44158==ERROR: AddressSanitizer: heap-use-after-free on address 0x6150012a67a0 at pc 0x000008c171be bp 0x7fffffffae70 sp 0x7fffffffae60 READ of size 8 at 0x6150012a67a0 thread T0 #0 0x8c171bd in blender::nodes::NodeTreeRef::NodeTreeRef(bNodeTree*) /home/jacques/blender-git/blender/source/blender/nodes/intern/node_tree_ref.cc:29 #1 0x8c3fbef in std::_MakeUniq::__single_object std::make_unique(bNodeTree*&&) /usr/include/c++/11.1.0/bits/unique_ptr.h:962 #2 0x8c2a6dc in operator() /home/jacques/blender-git/blender/source/blender/nodes/intern/node_tree_ref.cc:502 #3 0x8c2d09f in lookup_or_add_cb__impl > /home/jacques/blender-git/blender/source/blender/blenlib/BLI_map.hh:1139 #4 0x8c2bbd5 in lookup_or_add_cb_as > /home/jacques/blender-git/blender/source/blender/blenlib/BLI_map.hh:587 #5 0x8c2b19d in lookup_or_add_cb > /home/jacques/blender-git/blender/source/blender/blenlib/BLI_map.hh:582 #6 0x8c2a913 in blender::nodes::get_tree_ref_from_map(blender::Map >, 4l, blender::PythonProbingStrategy<1ul, false>, blender::DefaultHash, blender::DefaultEquality, blender::IntrusiveMapSlot >, blender::PointerKeyInfo >, blender::GuardedAllocator>&, bNodeTree&) /home/jacques/blender-git/blender/source/blender/nodes/intern/node_tree_ref.cc:501 #7 0x8b17506 in blender::nodes::DerivedNodeTree::construct_context_recursively(blender::nodes::DTreeContext*, blender::nodes::NodeRef const*, bNodeTree&, blender::Map >, 4l, blender::PythonProbingStrategy<1ul, false>, blender::DefaultHash, blender::DefaultEquality, blender::IntrusiveMapSlot >, blender::PointerKeyInfo >, blender::GuardedAllocator>&) /home/jacques/blender-git/blender/source/blender/nodes/intern/derived_node_tree.cc:44 #8 0x8b17bdb in blender::nodes::DerivedNodeTree::construct_context_recursively(blender::nodes::DTreeContext*, blender::nodes::NodeRef const*, bNodeTree&, blender::Map >, 4l, blender::PythonProbingStrategy<1ul, false>, blender::DefaultHash, blender::DefaultEquality, blender::IntrusiveMapSlot >, blender::PointerKeyInfo >, blender::GuardedAllocator>&) /home/jacques/blender-git/blender/source/blender/nodes/intern/derived_node_tree.cc:52 #9 0x8b16f07 in blender::nodes::DerivedNodeTree::DerivedNodeTree(bNodeTree&, blender::Map >, 4l, blender::PythonProbingStrategy<1ul, false>, blender::DefaultHash, blender::DefaultEquality, blender::IntrusiveMapSlot >, blender::PointerKeyInfo >, blender::GuardedAllocator>&) /home/jacques/blender-git/blender/source/blender/nodes/intern/derived_node_tree.cc:32 #10 0x733eff2 in modifyGeometry /home/jacques/blender-git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1048 #11 0x7340f9c in modifyGeometrySet /home/jacques/blender-git/blender/source/blender/modifiers/intern/MOD_nodes.cc:1104 #12 0x51da568 in modifier_modify_mesh_and_geometry_set /home/jacques/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:954 #13 0x51df078 in mesh_calc_modifiers /home/jacques/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:1306 #14 0x51eaa2f in mesh_build_data /home/jacques/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:1932 #15 0x51ed51a in makeDerivedMesh /home/jacques/blender-git/blender/source/blender/blenkernel/intern/DerivedMesh.cc:2080 #16 0x37fa573 in BKE_object_handle_data_update /home/jacques/blender-git/blender/source/blender/blenkernel/intern/object_update.c:202 #17 0x37fe909 in BKE_object_eval_uber_data /home/jacques/blender-git/blender/source/blender/blenkernel/intern/object_update.c:388 #18 0x1ff691f5 in operator() /home/jacques/blender-git/blender/source/blender/depsgraph/intern/builder/deg_builder_nodes.cc:1456 #19 0x1ffb11b7 in __invoke_impl&, Depsgraph*> /usr/include/c++/11.1.0/bits/invoke.h:61 #20 0x1ffa443e in __invoke_r&, Depsgraph*> /usr/include/c++/11.1.0/bits/invoke.h:111 #21 0x1ff97fb1 in _M_invoke /usr/include/c++/11.1.0/bits/std_function.h:291 #22 0x1fed5dfe in std::function::operator()(Depsgraph*) const /usr/include/c++/11.1.0/bits/std_function.h:560 #23 0x1fecf0f8 in evaluate_node /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:113 #24 0x1fecf178 in deg_task_run_func /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:124 #25 0x229c70d2 in operator() /home/jacques/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:184 #26 0x229cb9f3 in operator() /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:96 #27 0x5c984a4 in tbb::interface7::internal::isolate_within_arena(tbb::interface7::internal::delegate_base&, long) (/home/jacques/blender-git/build_linux/bin/blender+0x5c984a4) #28 0x229cb1b4 in isolate_impl > /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:216 #29 0x229cae3d in isolate > /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_arena.h:472 #30 0x229c72df in Task::operator()() const /home/jacques/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:184 #31 0x229cdb92 in tbb::internal::function_task::execute() /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:1059 #32 0x5ca9304 in tbb::internal::custom_scheduler::process_bypass_loop(tbb::internal::context_guard_helper&, tbb::task*, long) (/home/jacques/blender-git/build_linux/bin/blender+0x5ca9304) #33 0x5ca95ba in tbb::internal::custom_scheduler::local_wait_for_all(tbb::task&, tbb::task*) (/home/jacques/blender-git/build_linux/bin/blender+0x5ca95ba) #34 0x7aecf5b in tbb::task::wait_for_all() /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task.h:820 #35 0x7aef220 in tbb::internal::task_group_base::wait() /home/jacques/blender-git/lib/linux_centos7_x86_64/tbb/include/tbb/task_group.h:168 #36 0x229c860c in tbb_task_pool_work_and_wait /home/jacques/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:279 #37 0x229caa18 in BLI_task_pool_work_and_wait /home/jacques/blender-git/blender/source/blender/blenlib/intern/task_pool.cc:545 #38 0x1fed2c9a in blender::deg::deg_evaluate_on_refresh(blender::deg::Depsgraph*) /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval.cc:398 #39 0x1fd620e5 in deg_flush_updates_and_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:58 #40 0x1fd6234a in DEG_evaluate_on_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 #41 0x3ac1c13 in scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2654 #42 0x3ac1e3b in BKE_scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2703 #43 0x5cd6764 in wm_event_do_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387 #44 0x5cd6c63 in wm_event_do_refresh_wm_and_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412 #45 0x5cda60b in wm_event_do_notifiers /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:621 #46 0x5cb881d in WM_main /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm.c:650 #47 0x30ce8df in main /home/jacques/blender-git/blender/source/creator/creator.c:558 #48 0x7ffff7028b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) #49 0x30cd49d in _start (/home/jacques/blender-git/build_linux/bin/blender+0x30cd49d) 0x6150012a67a0 is located 288 bytes inside of 512-byte region [0x6150012a6680,0x6150012a6880) freed by thread T0 here: #0 0x7ffff7669d69 in operator delete(void*, unsigned long) /build/gcc/src/gcc/libsanitizer/asan/asan_new_delete.cpp:172 #1 0x1fd8e890 in __gnu_cxx::new_allocator::deallocate(blender::deg::OperationNode**, unsigned long) /usr/include/c++/11.1.0/ext/new_allocator.h:139 #2 0x1fd88fe2 in std::allocator_traits >::deallocate(std::allocator&, blender::deg::OperationNode**, unsigned long) /usr/include/c++/11.1.0/bits/alloc_traits.h:492 #3 0x1fd84a89 in std::_Deque_base >::_M_deallocate_node(blender::deg::OperationNode**) /usr/include/c++/11.1.0/bits/stl_deque.h:568 #4 0x1fd80b5e in std::deque >::_M_pop_front_aux() /usr/include/c++/11.1.0/bits/deque.tcc:578 #5 0x1fd7cfbd in std::deque >::pop_front() /usr/include/c++/11.1.0/bits/stl_deque.h:1542 #6 0x1fef00f5 in blender::deg::deg_graph_flush_updates(blender::deg::Depsgraph*) /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:378 #7 0x1fd620c7 in deg_flush_updates_and_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:57 #8 0x1fd6234a in DEG_evaluate_on_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 #9 0x3ac1c13 in scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2654 #10 0x3ac1e3b in BKE_scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2703 #11 0x5cd6764 in wm_event_do_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387 #12 0x5cd6c63 in wm_event_do_refresh_wm_and_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412 #13 0x5cda60b in wm_event_do_notifiers /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:621 #14 0x5cb881d in WM_main /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm.c:650 #15 0x30ce8df in main /home/jacques/blender-git/blender/source/creator/creator.c:558 #16 0x7ffff7028b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) previously allocated by thread T0 here: #0 0x7ffff7668ca1 in operator new(unsigned long) /build/gcc/src/gcc/libsanitizer/asan/asan_new_delete.cpp:99 #1 0x1fd8eb5a in __gnu_cxx::new_allocator::allocate(unsigned long, void const*) /usr/include/c++/11.1.0/ext/new_allocator.h:121 #2 0x1fd8aaf6 in std::allocator_traits >::allocate(std::allocator&, unsigned long) /usr/include/c++/11.1.0/bits/alloc_traits.h:460 #3 0x1fd8580a in std::_Deque_base >::_M_allocate_node() /usr/include/c++/11.1.0/bits/stl_deque.h:561 #4 0x1fd81aa7 in void std::deque >::_M_push_front_aux(blender::deg::OperationNode* const&) /usr/include/c++/11.1.0/bits/deque.tcc:533 #5 0x1fd7d888 in std::deque >::push_front(blender::deg::OperationNode* const&) /usr/include/c++/11.1.0/bits/stl_deque.h:1468 #6 0x1feecac5 in flush_schedule_children /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:198 #7 0x1fef07ad in blender::deg::deg_graph_flush_updates(blender::deg::Depsgraph*) /home/jacques/blender-git/blender/source/blender/depsgraph/intern/eval/deg_eval_flush.cc:388 #8 0x1fd620c7 in deg_flush_updates_and_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:57 #9 0x1fd6234a in DEG_evaluate_on_refresh /home/jacques/blender-git/blender/source/blender/depsgraph/intern/depsgraph_eval.cc:73 #10 0x3ac1c13 in scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2654 #11 0x3ac1e3b in BKE_scene_graph_update_tagged /home/jacques/blender-git/blender/source/blender/blenkernel/intern/scene.c:2703 #12 0x5cd6764 in wm_event_do_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:387 #13 0x5cd6c63 in wm_event_do_refresh_wm_and_depsgraph /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:412 #14 0x5cda60b in wm_event_do_notifiers /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm_event_system.c:621 #15 0x5cb881d in WM_main /home/jacques/blender-git/blender/source/blender/windowmanager/intern/wm.c:650 #16 0x30ce8df in main /home/jacques/blender-git/blender/source/creator/creator.c:558 #17 0x7ffff7028b24 in __libc_start_main (/usr/lib/libc.so.6+0x27b24) SUMMARY: AddressSanitizer: heap-use-after-free /home/jacques/blender-git/blender/source/blender/nodes/intern/node_tree_ref.cc:29 in blender::nodes::NodeTreeRef::NodeTreeRef(bNodeTree*) Shadow bytes around the buggy address: 0x0c2a8024cca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c2a8024ccb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa 0x0c2a8024ccc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024ccd0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cce0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x0c2a8024ccf0: fa fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cd00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cd10: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cd20: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cd30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c2a8024cd40: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==44158==ABORTING