The BM_mesh_bm_to_me() function copies shape keys from the BMesh to the Mesh. However, it tries to copy the same number of shape keys as are defined on the target mesh. Since the target mesh does not necessarily have the same number of shape keys as the BMesh, this would crash if the target Mesh has more.
Found while performing some tests for D7785: Fix T65148: Can't use shape key properties in driver when modifiers generate a new mesh.
To reproduce the issue:
- Open the attached blend file in a debug build of Blender.
- Run the code in the text editor.
- Assertion failure:
blender: …/blender/source/blender/bmesh/intern/bmesh_mesh_conv.c:941: BM_mesh_bm_to_me: Assertion `cd_shape_offset != -1' failed.
Note that even with this fix, the remaining shapekeys on the mesh are invalid. It might be desirable to delete the shapekeys before or after the operation, but I feel that this is out of the scope of the BM_mesh_bm_to_me() function.