Segfault when hitting tab #48666

New Issue

Jaggz H · 2016-06-17T11:28:24+02:00

Jaggz H commented

2016-06-17 11:28:24 +02:00

System Information
Debian Jessie (Stable)
Nvidia GTX 970

Blender Version
Broken: Blender 2.77 (sub 0), Commit date: 2016-03-07 00:28, Hash 42e8660
Worked: (optional)

Load .blend, tab into edit mode, tab back out

Exact steps for others to reproduce the error
Load .blend, tab into edit mode, tab back out.

The object is boolean union target (one of many) on another object.
That other object is a boolean difference target of the large object in the scene.

tray-mouth-01-taperingback.blend
tray-mouth-01-taperingback.crash.txt

**System Information** Debian Jessie (Stable) Nvidia GTX 970 **Blender Version** Broken: Blender 2.77 (sub 0), Commit date: 2016-03-07 00:28, Hash 42e8660 Worked: (optional) Load .blend, tab into edit mode, tab back out **Exact steps for others to reproduce the error** Load .blend, tab into edit mode, tab back out. The object is boolean union target (one of many) on another object. That other object is a boolean difference target of the large object in the scene. [tray-mouth-01-taperingback.blend](https://archive.blender.org/developer/F317414/tray-mouth-01-taperingback.blend) [tray-mouth-01-taperingback.crash.txt](https://archive.blender.org/developer/F317415/tray-mouth-01-taperingback.crash.txt)

Jaggz H commented

2016-06-17 11:28:24 +02:00

Changed status to: 'Open'

Jaggz H commented

2016-06-17 11:28:24 +02:00

Added subscriber: @jaggz

NikoLeopold commented

2016-06-17 13:45:03 +02:00

Added subscriber: @NikoLeopold

NikoLeopold commented

2016-06-17 13:45:03 +02:00

There are dependency graph cycles: The children of Slot-0-LEADER depend on it as a parent, and Slot-0-LEADER depends on its children via Boolean Modifiers.
This alone should not be a reason for a crash though. Crash only happens for Slot-0-LEADER with Slot-2 or Slot-3 which all use the same mesh.

Clearing the parent relationship or making single-user copies of that mesh avoids the crash.

There are dependency graph cycles: The children of Slot-0-LEADER depend on it as a parent, and Slot-0-LEADER depends on its children via Boolean Modifiers. This alone should not be a reason for a crash though. Crash only happens for Slot-0-LEADER with Slot-2 or Slot-3 which all use the same mesh. Clearing the parent relationship or making single-user copies of that mesh avoids the crash.

Aaron Carlisle commented

2016-06-20 03:13:16 +02:00

Added subscribers: @Sergey, @ideasman42

Bastien Montagne self-assigned this 2016-06-21 17:19:13 +02:00

Bastien Montagne removed their assignment 2016-06-21 19:09:02 +02:00

Campbell Barton was assigned by Sergey Sharybin

2016-06-30 14:19:24 +02:00

Sergey Sharybin commented

2016-06-30 14:19:24 +02:00

This is nothing to do with the dependency graph. You can easily rule that out using -t 1 command line argument.

Actual issue is that after toggling edit mode mloop array of some of the operand gets invalid vertex indices. That's easy to see with this patch:

P371: Snippet for #48666

diff --git a/source/blender/modifiers/intern/MOD_boolean_util.c b/source/blender/modifiers/intern/MOD_boolean_util.c
index 061b119..53f3d0c 100644
--- a/source/blender/modifiers/intern/MOD_boolean_util.c
+++ b/source/blender/modifiers/intern/MOD_boolean_util.c
@@ -105,6 +105,9 @@ static void dm_arrays_get(DerivedMesh *dm, DMArrays *arrays)
 	arrays->mvert = DM_get_vert_array(dm, &arrays->mvert_allocated);
 	arrays->medge = DM_get_edge_array(dm, &arrays->medge_allocated);
 	arrays->mloop = DM_get_loop_array(dm, &arrays->mloop_allocated);
+	for (int i = 0; i < dm->getNumLoops(dm); ++i) {
+		BLI_assert(arrays->mloop- [x].v < dm->getNumVerts(dm));
+	}
 	arrays->mpoly = DM_get_poly_array(dm, &arrays->mpoly_allocated);
 }
 
@@ -197,11 +200,18 @@ static int importer_GetPolyNumVerts(ImportMeshData *import_data, int poly_index)
 /* Get list of adjucent vertices to the poly specified by it's index. */
 static void importer_GetPolyVerts(ImportMeshData *import_data, int poly_index, int *verts)
 {
+	BLI_assert(poly_index >= 0);
+	BLI_assert(poly_index < import_data->dm->getNumPolys(import_data->dm));
 	MPoly *mpoly = &import_data->mpoly[poly_index];
+	BLI_assert(mpoly->loopstart >= 0);
+	BLI_assert(mpoly->loopstart < import_data->dm->getNumLoops(import_data->dm));
 	MLoop *mloop = import_data->mloop + mpoly->loopstart;
 	int i;
 	BLI_assert(poly_index >= 0 && poly_index < import_data->dm->getNumPolys(import_data->dm));
 	for (i = 0; i < mpoly->totloop; i++, mloop++) {
+		BLI_assert(mpoly->loopstart + i < import_data->dm->getNumLoops(import_data->dm));
+		BLI_assert(mloop->v >= 0);
+		BLI_assert(mloop->v < import_data->dm->getNumVerts(import_data->dm));
 		verts- [x] = mloop->v;
 	}
 }

@ideasman42, mind giving some help troubleshooting where exactly index gets corrupted?

This is nothing to do with the dependency graph. You can easily rule that out using `-t 1` command line argument. Actual issue is that after toggling edit mode mloop array of some of the operand gets invalid vertex indices. That's easy to see with this patch: [P371: Snippet for #48666](https://archive.blender.org/developer/P371.txt) ``` diff --git a/source/blender/modifiers/intern/MOD_boolean_util.c b/source/blender/modifiers/intern/MOD_boolean_util.c index 061b119..53f3d0c 100644 --- a/source/blender/modifiers/intern/MOD_boolean_util.c +++ b/source/blender/modifiers/intern/MOD_boolean_util.c @@ -105,6 +105,9 @@ static void dm_arrays_get(DerivedMesh *dm, DMArrays *arrays) arrays->mvert = DM_get_vert_array(dm, &arrays->mvert_allocated); arrays->medge = DM_get_edge_array(dm, &arrays->medge_allocated); arrays->mloop = DM_get_loop_array(dm, &arrays->mloop_allocated); + for (int i = 0; i < dm->getNumLoops(dm); ++i) { + BLI_assert(arrays->mloop- [x].v < dm->getNumVerts(dm)); + } arrays->mpoly = DM_get_poly_array(dm, &arrays->mpoly_allocated); } @@ -197,11 +200,18 @@ static int importer_GetPolyNumVerts(ImportMeshData *import_data, int poly_index) /* Get list of adjucent vertices to the poly specified by it's index. */ static void importer_GetPolyVerts(ImportMeshData *import_data, int poly_index, int *verts) { + BLI_assert(poly_index >= 0); + BLI_assert(poly_index < import_data->dm->getNumPolys(import_data->dm)); MPoly *mpoly = &import_data->mpoly[poly_index]; + BLI_assert(mpoly->loopstart >= 0); + BLI_assert(mpoly->loopstart < import_data->dm->getNumLoops(import_data->dm)); MLoop *mloop = import_data->mloop + mpoly->loopstart; int i; BLI_assert(poly_index >= 0 && poly_index < import_data->dm->getNumPolys(import_data->dm)); for (i = 0; i < mpoly->totloop; i++, mloop++) { + BLI_assert(mpoly->loopstart + i < import_data->dm->getNumLoops(import_data->dm)); + BLI_assert(mloop->v >= 0); + BLI_assert(mloop->v < import_data->dm->getNumVerts(import_data->dm)); verts- [x] = mloop->v; } } ``` @ideasman42, mind giving some help troubleshooting where exactly index gets corrupted?

Campbell Barton was unassigned by Sergey Sharybin

2016-07-01 13:47:07 +02:00

Sergey Sharybin self-assigned this 2016-07-01 13:47:07 +02:00

Sergey Sharybin commented

2016-07-01 13:47:07 +02:00

Actually, the issue does not happen with boolean modifier disabled, so afraid it's bug in Carve or in glue API which goes to my desk.

blender-admin commented

2016-07-01 14:25:30 +02:00

This issue was referenced by 158679c9cc

This issue was referenced by 158679c9cc0f024fd54874f48e82cc00072caab4

Sergey Sharybin commented

2016-07-01 14:25:50 +02:00

Changed status from 'Open' to: 'Resolved'

Sergey Sharybin closed this issue

2016-07-01 14:25:50 +02:00

Sign in to join this conversation.

No Label

Download

What's New

Blender Studio

Manual

Developers Blog

Documentation

Benchmark

Blender Conference

Development Fund

One-time Donations

Segfault when hitting tab #48666