Crash on namespace edit inside a variant edit target

BigRoy commented 11 months ago

Description of Issue

I'd like to be able to apply an Sdf.NamespaceEdit inside a variant edit target, but it keeps crashing on me.

Running it in Maya provides me this crash log:

Click to show Maya Crash Report

``` //===================================================== Maya Crash Report //===================================================== Exception code: C0000005: ACCESS_VIOLATION - illegal read at address 0x00000000 Fault address: D502A5FF in C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\usd_pcp.dll 0001:001895FF Logical offset (see .map file for location) Call stack: Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\usd_usd.dll (-exported-) Location: usd_usd.dllpxrInternal_v0_22__pxrReserved__::UsdAttributeQuery::_Get > + 79B164 bytes Decl: private: bool __cdecl pxrInternal_v0_22__pxrReserved__::UsdAttributeQuery::_Get >(class pxrInternal_v0_22__pxrReserved__::VtArray > + 488E40 bytes Decl: private: bool __cdecl pxrInternal_v0_22__pxrReserved__::UsdAttributeQuery::_Get >(class pxrInternal_v0_22__pxrReserved__::VtArray const & __ptr64)const __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\python\pxr\Tf\_tf.pyd (-exported-) Location: _tf.pydpxrInternal_v0_22__pxrReserved__::tfTestStaticTokens_StaticTokenType::tfTestStaticTokens_StaticTokenType + 619F0 bytes Decl: public: __cdecl pxrInternal_v0_22__pxrReserved__::tfTestStaticTokens_StaticTokenType::tfTestStaticTokens_StaticTokenType(void) __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::handle_exception_impl + 47 bytes Decl: bool __cdecl boost::python::handle_exception_impl(class boost::function0) Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::objects::static_data + 35A bytes Decl: struct _object * __ptr64 __cdecl boost::python::objects::static_data(void) Module: C:\Program Files\Autodesk\Maya2024\bin\python310.dll (-exported-) Location: python310.dll_PyObject_Call + 96 bytes Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\usd_tf.dll (-exported-) Location: usd_tf.dllpxrInternal_v0_22__pxrReserved__::TfPyEnsureGILUnlockedObj::TfPyEnsureGILUnlockedObj + 13415F bytes Decl: public: __cdecl pxrInternal_v0_22__pxrReserved__::TfPyEnsureGILUnlockedObj::TfPyEnsureGILUnlockedObj(void) __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::objects::function::call + 2D3 bytes Decl: public: struct _object * __ptr64 __cdecl boost::python::objects::function::call(struct _object * __ptr64,struct _object * __ptr64)const __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::objects::static_data + 2AA bytes Decl: struct _object * __ptr64 __cdecl boost::python::objects::static_data(void) Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::detail::exception_handler::operator() + 3B bytes Decl: public: bool __cdecl boost::python::detail::exception_handler::operator()(class boost::function0 const & __ptr64)const __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\python\pxr\Tf\_tf.pyd (-exported-) Location: _tf.pydpxrInternal_v0_22__pxrReserved__::tfTestStaticTokens_StaticTokenType::tfTestStaticTokens_StaticTokenType + 619F0 bytes Decl: public: __cdecl pxrInternal_v0_22__pxrReserved__::tfTestStaticTokens_StaticTokenType::tfTestStaticTokens_StaticTokenType(void) __ptr64 Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::handle_exception_impl + 47 bytes Decl: bool __cdecl boost::python::handle_exception_impl(class boost::function0) Module: C:\Program Files\Autodesk\MayaUSD\Maya2024\0.26.0_202311130904-e634cda\mayausd\USD\lib\boost_python310-vc142-mt-x64-1_76.dll (-exported-) Location: boost_python310-vc142-mt-x64-1_76.dllboost::python::objects::static_data + 35A bytes Decl: struct _object * __ptr64 __cdecl boost::python::objects::static_data(void) ```

It also crashes outside of Maya in Python with usd-core but I'm not sure how to get such a crash dump there.

See the reproducible example further down below in Steps to reproduce for more details - the following details apply to that reproducable.

It seems fine to access the PrimSpec through the Sdf.Layer instead of going through the Usd.Prim.GetPrimStack()

def debug(path):
    print("{:<30} {}".format(path.pathString, layer.GetPrimAtPath(path)))

layer.Traverse("/", debug)

Which prints:

/root{model=main}new_name      Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/root{model=main}new_name')
/root{model=main}              Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/root{model=main}')
/root{model=damaged}           Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/root{model=damaged}')
/root{model=ice}               Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/root{model=ice}')
/root{model=}                  None
/root                          Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/root')
/                              Sdf.Find('anon:000001E0BA91E820:tmp.usda', '/')

Still - any app is likely to crash as soon as it starts touching the prim stacks, etc.

I wonder if this hints to anything, for the crashing prim when using prim.GetPrimStack() :warning: :

the Usd.Prim.GetPrimIndex() returns None
however it is considered valid Usd.Prim.IsValid() == True.
this also crashes: Usd.Prim.ComputeExpandedPrimIndex() :warning:

Originally reported on USD Alliance forum here

Steps to Reproduce

Here's a Python snippet that reproduces the crash.

from pxr import Usd, Sdf

# Create a stage with a root xform
stage = Usd.Stage.CreateInMemory()
prim = stage.DefinePrim("/root", "Xform")

# Add variant set
variant_sets = prim.GetVariantSets()
variant_set = variant_sets.AddVariantSet("model")

# Add some variants
variant_set.AddVariant("main")
variant_set.AddVariant("damaged")
variant_set.AddVariant("ice")

# Set the variant selection
variant_set.SetVariantSelection("main")

edit_target = variant_set.GetVariantEditTarget()
stage.SetEditTarget(edit_target)

child = stage.DefinePrim("/root/child", "Xform")
spec = next(iter(child.GetPrimStack()))  # there is only one prim spec in this case, it's in the variant set
assert spec.path == '/root{model=main}child'

# Rename, keep parent
edit = Sdf.NamespaceEdit.Rename(
    spec.path,
    "new_name"
)

layer = spec.layer
batch_edit = Sdf.BatchNamespaceEdit()
batch_edit.Add(edit)
layer.Apply(batch_edit)

child = stage.GetPrimAtPath("/root/new_name")
assert child, "Renamed child must exist"
assert not stage.GetPrimAtPath("/root/child"), "Old prim name must not exist"

# However, now accessing the prim stack for the renamed prim crashes
prim_stack = child.GetPrimStack()  # CRASH

System Information (OS, Hardware)

OS: Windows 10 64 bit Machine: HP-Z820-02 (nothing special really)

Package Versions

Tested with both usd-core 23.11 python package and MayaUSD 0.26.0

Build Flags

n/a - releases from pip and Maya-USD.

jesschimein commented 11 months ago

Filed as internal issue #USD-9039

jpankalainen commented 9 months ago

Hello,

I managed to reproduce the crash with the attached C++ snippet today. Looks like the _primIndex of the new prim is null after the rename, so I'm guessing something doesn't trigger recomposition properly if prim is only defined inside a variant.

https://gist.github.com/jpankalainen/c39ebd205a383ed163f155a3a418c2ea

PixarAnimationStudios / OpenUSD