View Issue Details

IDProjectCategoryView StatusLast Update
0032929CommunityOCCT:Modeling Algorithmspublic2023-03-19 19:11
ReporterCharlemagneLasse Assigned ToCharlemagneLasse  
PrioritynormalSeveritycrash 
Status closedResolutionfixed 
PlatformLinuxOSDebian bullseye amd64 
Product Version7.5.3 
Target Version7.6.3Fixed in Version7.6.3 
Summary0032929: Modeling Algorithms - Crash in PerformIntersectionAtEnd after deletion of surfdata
Description(This problem was seen with the version bundled with FreeCAD 0.20.28445 but can be reproduced easily with the master version directly from OCCT)

When creating a fillet, num is calculated via ChFi3d_IndexOfSurfData. If it returns just the number of entries in surfdata, it can happen that this value becomes invalid when handling the case "two faces common to the edge are found". When both components are on an arc, there will be num removed from the surfdata.

num would then be larger than the number of entries surfdata. The derived num1 is therefore also incorrect. The subsequent usage of this value will either:

* Debug build: cause an out of bounds exception in ChangeValue (`SeqFil.ChangeValue(num)`)
* Release build: cause a segfault when retrieving it via index num1 (`SeqFil(num1)`)

More information (including how it was debugged) can be found at:

* https://github.com/realthunder/FreeCAD/issues/309#issuecomment-1095028193
* https://forum.freecadweb.org/viewtopic.php?p=587178#p587178
Steps To Reproduce# get most recent OCCT
$ cd /tmp/
$ git clone https://git.dev.opencascade.org/repos/occt.git OCCT

# get build dependencies based on opencascade package in the Debian package source (deb-src) repository. will most likely work differently on whatever Distro you are using
$ sudo apt build-dep opencascade

# build everything (I only have 4 cores - you might change it if you are not working on a system with a 10 year old CPU)
$ cd OCCT
$ git am /tmp/0001-Add-workaround-patches-for-fillet-crashes.txt
$ mkdir build
$ cd build
$ cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_VERBOSE_MAKEFILE=true && make -j4

# prepare reproducer script
$ cd /tmp/OCCT/
$ cat > test.script << "EOF"
# init modules
pload ALL

# load
restore /tmp/PartShape8.brp b

# get all edges for the body and create fillet on "right" arc
explode b E
blend b b 1 b_8
EOF

# start DRAWEXE shell
# usually I would have done it like that. But it is then not 100% reproducible due to various system effects.
# So I just use gdb in the actual command to improve my live and make it 100% reproducible
#$ LD_LIBRARY_PATH=/tmp/OCCT/build/lin64/gcc/lib/ CASROOT=/tmp/OCCT ./build/lin64/gcc/bin/DRAWEXE -f test.script

$ LD_LIBRARY_PATH=/tmp/OCCT/build/lin64/gcc/lib/ CASROOT=/tmp/OCCT gdb -q --ex run --args ./build/lin64/gcc/bin/DRAWEXE -f test.script
TagsNo tags attached.
Test case numberbugs/modalg_8/bug32929

Attached Files

  • PartShape8.brp (28,604 bytes)
  • crash.txt (42,359 bytes)
  • bug32929.brep (28,604 bytes)

Activities

CharlemagneLasse

2022-04-13 15:05

developer  

PartShape8.brp (28,604 bytes)
crash.txt (42,359 bytes)

git

2022-04-13 15:15

administrator   ~0107914

Branch CR32929 has been created by CharlemagneLasse.

SHA-1: 1402e41b7d7a673d4cdc5dff8aea7af67537aecd


Detailed log of new commits:

Author: Charlemagne Lasse
Date: Wed Apr 13 11:54:30 2022 +0200

    0032929: Modeling Algorithm - In PerformIntersectionAtEnd Recalculate index of surfdata after deletion
    
    When creating a fillet, num is calculated via ChFi3d_IndexOfSurfData. If it
    returns just the number of entries in surfdata, it can happen that this
    value becomes invalid when handling the case "two faces common to the edge
    are found". When both components are on an arc, there will be num removed
    from the surfdata.
    
    num would then be larger than the number of entries surfdata. The derived
    num1 is therefore also incorrect. The subsequent usage of this
    value will either:
    
    * Debug build: cause an out of bounds exception in ChangeValue
      (`SeqFil.ChangeValue(num)`)
    * Release build: cause a segfault when retrieving it via index num1
      (`SeqFil(num1)`)
    
    num + num1 must be recalculated after the deletion happens to correctly
    calculate the fillet.
    
    Signed-off-by: Charlemagne Lasse <charlemagnelasse@gmail.com>

CharlemagneLasse

2022-04-13 15:23

developer   ~0107918

Last edited: 2022-04-13 15:41

According to https://dev.opencascade.org/get_involved, I should do following: "Push your change to Git repository in branch with name starting with "CR" followed by the issue Id, then switch the issue to Resolved.". But I don't have any button to do this.

EDIT: Problem was solved by azv

CharlemagneLasse

2022-05-27 09:39

developer   ~0108637

I was asked to bump this ticket. What can/should be done here to continue forward?

git

2022-06-02 08:22

administrator   ~0108778

Branch CR32929 has been updated forcibly by aml.

SHA-1: 69b4156b8aa9da1ce39f14c723f592d29067facb

aml

2022-06-02 08:23

developer   ~0108779

Attach shape with proper name.
bug32929.brep (28,604 bytes)

git

2022-06-02 08:27

administrator   ~0108780

Branch CR32929 has been updated forcibly by aml.

SHA-1: 9b2092b0985711cbc25f17089ba5c0dd36cf3e84

aml

2022-06-03 06:59

developer   ~0108808

Dear Artem,
I've prepared test case and have launched testing. Jenkins job is:

http://jenkins-test-occt/view/CR32929-master-aml/view/ALL/

Could you please take a look at the patch?

afokin

2022-06-04 10:03

administrator   ~0108845

Combination -
OCCT branch : IR-2022-06-04
master SHA - 24e4b3c83b237dad583f87c983eb06433d56c203
e0ceb716c70188b98130b1550914140d0502a6f9
Products branch : IR-2022-06-04 SHA - ad07e82b28135dbba6cde30827d08f1c0598cf50
was compiled on Linux, MacOS and Windows platforms and tested in optimize mode.

Number of compiler warnings:
No new/fixed warnings

Regressions/Differences/Improvements:
No regressions/differences

CPU differences:
Debian80-64:
OCCT
Total CPU difference: 18736.560000000623 / 18755.550000000607 [-0.10%]
Products
Total CPU difference: 11708.410000000114 / 11723.710000000106 [-0.13%]
Windows-64-VC14:
OCCT
Total CPU difference: 20637.375 / 20721.125 [-0.40%]
Products
Total CPU difference: 13299.6875 / 13249.9375 [+0.38%]


Image differences :
No differences that require special attention

Memory differences :
No differences that require special attention

git

2022-06-04 12:59

administrator   ~0108854

Branch CR32929 has been deleted by mnt.

SHA-1: 9b2092b0985711cbc25f17089ba5c0dd36cf3e84

Related Changesets

occt: master 24e4b3c8

2022-04-13 12:54:30

CharlemagneLasse


Committer: afokin Details Diff
0032929: Modeling Algorithms - Crash in PerformIntersectionAtEnd after deletion of surfdata

When creating a fillet, num is calculated via ChFi3d_IndexOfSurfData. If it
returns just the number of entries in surfdata, it can happen that this
value becomes invalid when handling the case "two faces common to the edge
are found". When both components are on an arc, there will be num removed
from the surfdata.

num would then be larger than the number of entries surfdata. The derived
num1 is therefore also incorrect. The subsequent usage of this
value will either:

* Debug build: cause an out of bounds exception in ChangeValue
(`SeqFil.ChangeValue(num)`)
* Release build: cause a segfault when retrieving it via index num1
(`SeqFil(num1)`)

num + num1 must be recalculated after the deletion happens to correctly
calculate the fillet.

Signed-off-by: Charlemagne Lasse <charlemagnelasse@gmail.com>
Affected Issues
0032929
mod - src/ChFi3d/ChFi3d_Builder_C1.cxx Diff File
add - tests/bugs/modalg_8/bug32929 Diff File

Issue History

Date Modified Username Field Change
2022-04-13 15:05 CharlemagneLasse New Issue
2022-04-13 15:05 CharlemagneLasse Assigned To => msv
2022-04-13 15:05 CharlemagneLasse File Added: PartShape8.brp
2022-04-13 15:05 CharlemagneLasse File Added: crash.txt
2022-04-13 15:15 git Note Added: 0107914
2022-04-13 15:23 CharlemagneLasse Note Added: 0107918
2022-04-13 15:37 CharlemagneLasse Status new => resolved
2022-04-13 15:40 CharlemagneLasse Note Edited: 0107918
2022-04-13 15:41 CharlemagneLasse Note Edited: 0107918
2022-04-13 15:54 msv Assigned To msv => azv
2022-05-27 09:39 CharlemagneLasse Note Added: 0108637
2022-06-02 08:18 aml Summary Crash in PerformIntersectionAtEnd after deletion of surfdata => Modeling Algorithms - Crash in PerformIntersectionAtEnd after deletion of surfdata
2022-06-02 08:22 git Note Added: 0108778
2022-06-02 08:23 aml Note Added: 0108779
2022-06-02 08:23 aml File Added: bug32929.brep
2022-06-02 08:27 git Note Added: 0108780
2022-06-02 09:05 azv Assigned To azv => aml
2022-06-03 06:44 aml Assigned To aml => CharlemagneLasse
2022-06-03 06:57 aml Assigned To CharlemagneLasse => azv
2022-06-03 06:59 aml Note Added: 0108808
2022-06-03 07:34 azv Assigned To azv => bugmaster
2022-06-03 07:34 azv Status resolved => reviewed
2022-06-03 07:35 azv Target Version => 7.6.3
2022-06-03 07:35 azv Test case number => bugs/modalg_8/bug32929
2022-06-04 10:03 afokin Status reviewed => tested
2022-06-04 10:03 afokin Note Added: 0108845
2022-06-04 12:56 afokin Changeset attached => occt master 24e4b3c8
2022-06-04 12:56 CharlemagneLasse Assigned To bugmaster => CharlemagneLasse
2022-06-04 12:56 CharlemagneLasse Status tested => verified
2022-06-04 12:56 CharlemagneLasse Resolution open => fixed
2022-06-04 12:59 git Note Added: 0108854
2023-03-19 19:11 vglukhik Status verified => closed
2023-03-19 19:11 vglukhik Fixed in Version => 7.6.3