View Issue Details

IDProjectCategoryView StatusLast Update
0032931CommunityOCCT:Modeling Algorithmspublic2022-06-28 06:34
ReporterCharlemagneLasse Assigned ToCharlemagneLasse  
PrioritynormalSeveritycrash 
Status verifiedResolutionfixed 
PlatformLinuxOSDebian bullseye amd64 
Product Version7.5.3 
Target Version7.6.3 
Summary0032931: Crash in ChFi3d_IsInFront when no face was found
Description(This problem was seen with the version bundled with FreeCAD 0.20.28445 but can be reproduced easily with the master version directly from OCCT)

The ChFi3d_IsInFront code is currently not handling all the combinations correctly. For example, if `if(fd1->IndexOfS2() == fd2->IndexOfS2())` is true, it can happen that the `TopoDS::Face(DStr.Shape(fd1->Index(jf1)))` returns a Face with entity == NULL. The subsequent usage of this NULL face in `BRep_Tool::Parameters( Vtx, face )` will then cause a segfault.


More information (including how it was debugged) can be found at:

* https://github.com/FreeCAD/FreeCAD/issues/6625#issuecomment-1094139670
* https://forum.freecadweb.org/viewtopic.php?p=584239#p584239
Steps To Reproduce# get most recent OCCT
$ cd /tmp/
$ git clone https://git.dev.opencascade.org/repos/occt.git OCCT

# get build dependencies based on opencascade package in the Debian package source (deb-src) repository. will most likely work differently on whatever Distro you are using
$ sudo apt build-dep opencascade

# build everything (I only have 4 cores - you might change it if you are not working on a system with a 10 year old CPU)
$ cd OCCT
$ mkdir build
$ cd build
$ cmake .. -DCMAKE_BUILD_TYPE=Debug -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_VERBOSE_MAKEFILE=true && make -j4



# prepare reproducer script
$ cd /tmp/OCCT/
$ cat > test.script << "EOF"
# load the brp, get edges and then try to add fillet on the problematic edges
pload ALL
restore /tmp/Body.Shape.brp b
explode b E
blend b2 b 1 b_10 1 b_18 1 b_19 1 b_20 1 b_21 1 b_17

# REMARK: following line is also good enough to cause a crash (inner two edges of the L shape). But it is not the operation from the original reporter:
# blend b2 b 1 b_19 1 b_20
EOF

# start DRAWEXE shell
# usually I would have done it like that. But it is then not 100% reproducible due to various system effects.
# So I just use gdb in the actual command to improve my live and make it 100% reproducible
#$ LD_LIBRARY_PATH=/tmp/OCCT/build/lin64/gcc/libd/ CASROOT=/tmp/OCCT ./build/lin64/gcc/bind/DRAWEXE -f test.script

$ LD_LIBRARY_PATH=/tmp/OCCT/build/lin64/gcc/libd/ CASROOT=/tmp/OCCT gdb -q --ex run --args ./build/lin64/gcc/bind/DRAWEXE -f test.script
TagsNo tags attached.
Test case numbertests/bugs/modalg_8/bug32931

Attached Files

  • Body.Shape.brp (13,958 bytes)
  • crash2-V7_6_0-122-g2491eec38b.txt (38,237 bytes)
  • bug32931.brep (13,958 bytes)

Activities

CharlemagneLasse

2022-04-13 15:08

developer  

Body.Shape.brp (13,958 bytes)
crash2-V7_6_0-122-g2491eec38b.txt (38,237 bytes)

git

2022-04-13 15:16

administrator   ~0107915

Branch CR32931 has been created by CharlemagneLasse.

SHA-1: b64df5420f4debac579e57a8e9bed79b224616ff


Detailed log of new commits:

Author: Charlemagne Lasse
Date: Wed Apr 13 11:54:30 2022 +0200

    0032931: Modeling Algorithm - In PerformIntersectionAtEnd Avoid crash when no face was found
    
    The PerformIntersectionAtEnd code is currently not handling all the faces
    correctly. If it retrieves Face[0] as F, it can happen that the previously
    ran code didn't actually retrieve any faces in this array at all.
    
    For example when:
    
    * "if (nface==3)" is true
      - "if (!findonf1)" is true (doesn't assign any faces to this array)
      - "if (!findonf2)" is true (doesn't assign any faces to this array)
      - "if (state == ChFiDS_OnSame)" is not true (because it is
        ChFiDS_AllSame)
      - "if (findonf1 && !isOnSame1)" cannot be true (see above, but would
        handle faces)
      - "if (findonf2 && !isOnSame2)" cannot be true (see above, but would
        handle faces)
      - "if (isOnSame2)" is false (but would also handle faces)
    
    Since no faces were assigned here, F would be a NULL face. As result, the
    function will crash when trying to access the Surface behind the face via
    `BRep_Tool::Surface(F);`.
    
    While the best approach would be to identify the implementation bug in the
    algorithm behind PerformIntersectionAtEnd, a check + exception is used
    instead because the actual algorithm is not known.
    
    Signed-off-by: Charlemagne Lasse <charlemagnelasse@gmail.com>

git

2022-04-13 15:19

administrator   ~0107917

Branch CR32931 has been updated forcibly by CharlemagneLasse.

SHA-1: 4491adbef15c8c9a0c78190ba3a344f7ede505ed

CharlemagneLasse

2022-04-13 15:23

developer   ~0107920

Last edited: 2022-04-13 15:42

According to https://dev.opencascade.org/get_involved, I should do following: "Push your change to Git repository in branch with name starting with "CR" followed by the issue Id, then switch the issue to Resolved.". But I don't have any button to do this.

EDIT: Problem was solved by azv

kgv

2022-04-13 15:56

developer   ~0107925

Last edited: 2022-04-13 15:56

General comment - `Standard_Failure` is the base class in hierarchy of exceptions in OCCT, and is never expected to be thrown directly.
It is expected to throw some related exception subclass - like `Standard_NullObject` or `Standard_ProgramError`.

git

2022-04-13 16:27

administrator   ~0107927

Branch CR32931 has been updated forcibly by CharlemagneLasse.

SHA-1: a85e2df73d1d2055ac2d47a4c97e188835dca0c5

CharlemagneLasse

2022-05-27 09:38

developer   ~0108636

I was asked to bump this ticket. What can/should be done here to continue forward?

git

2022-06-02 10:45

administrator   ~0108788

Branch CR32931 has been updated forcibly by aml.

SHA-1: 9fe908fcfaf1395d0fce171fda5cf8df8ce37c70

aml

2022-06-02 10:45

developer   ~0108789

I attach shape with proper name.
bug32931.brep (13,958 bytes)

aml

2022-06-03 10:36

developer   ~0108815

Reviewed. Jenkins job is:
http://jenkins-test-occt/view/CR32931-master-aml/view/COMPARE/

afokin

2022-06-04 10:12

administrator   ~0108850

Combination -
OCCT branch : IR-2022-06-04
master SHA - 24e4b3c83b237dad583f87c983eb06433d56c203
e0ceb716c70188b98130b1550914140d0502a6f9
Products branch : IR-2022-06-04 SHA - ad07e82b28135dbba6cde30827d08f1c0598cf50
was compiled on Linux, MacOS and Windows platforms and tested in optimize mode.

Number of compiler warnings:
No new/fixed warnings

Regressions/Differences/Improvements:
No regressions/differences

CPU differences:
Debian80-64:
OCCT
Total CPU difference: 18736.560000000623 / 18755.550000000607 [-0.10%]
Products
Total CPU difference: 11708.410000000114 / 11723.710000000106 [-0.13%]
Windows-64-VC14:
OCCT
Total CPU difference: 20637.375 / 20721.125 [-0.40%]
Products
Total CPU difference: 13299.6875 / 13249.9375 [+0.38%]


Image differences :
No differences that require special attention

Memory differences :
No differences that require special attention

git

2022-06-04 12:59

administrator   ~0108856

Branch CR32931 has been deleted by mnt.

SHA-1: 9fe908fcfaf1395d0fce171fda5cf8df8ce37c70

Related Changesets

occt: master d30f25e6

2022-04-13 12:54:30

CharlemagneLasse


Committer: afokin Details Diff
0032931: Modeling Algorithms - Crash in ChFi3d_IsInFront when no face was found

The ChFi3d_IsInFront code is currently not handling all the combinations
correctly. For example, if `if(fd1->IndexOfS2() == fd2->IndexOfS2())` is
true, it can happen that the `TopoDS::Face(DStr.Shape(fd1->Index(jf1)))`
returns a Face with entity == NULL. The subsequent usage of this NULL face
in `BRep_Tool::Parameters( Vtx, face )` will then cause a segfault.

While the best approach would be to identify the implementation bug in the
algorithm behind PChFi3d_IsInFron, a check + exception is used instead
because the actual algorithm is not known.

Signed-off-by: Charlemagne Lasse <charlemagnelasse@gmail.com>
Affected Issues
0032931
mod - src/ChFi3d/ChFi3d_Builder_0.cxx Diff File
add - tests/bugs/modalg_8/bug32931 Diff File

Issue History

Date Modified Username Field Change
2022-04-13 15:08 CharlemagneLasse New Issue
2022-04-13 15:08 CharlemagneLasse Assigned To => msv
2022-04-13 15:08 CharlemagneLasse File Added: Body.Shape.brp
2022-04-13 15:08 CharlemagneLasse File Added: crash2-V7_6_0-122-g2491eec38b.txt
2022-04-13 15:16 git Note Added: 0107915
2022-04-13 15:19 git Note Added: 0107917
2022-04-13 15:23 CharlemagneLasse Note Added: 0107920
2022-04-13 15:38 CharlemagneLasse Status new => resolved
2022-04-13 15:42 CharlemagneLasse Note Edited: 0107920
2022-04-13 15:56 kgv Note Added: 0107925
2022-04-13 15:56 kgv Note Edited: 0107925
2022-04-13 15:58 msv Assigned To msv => azv
2022-04-13 16:27 git Note Added: 0107927
2022-05-27 09:38 CharlemagneLasse Note Added: 0108636
2022-06-02 09:06 azv Assigned To azv => aml
2022-06-02 10:45 git Note Added: 0108788
2022-06-02 10:45 aml Note Added: 0108789
2022-06-02 10:45 aml File Added: bug32931.brep
2022-06-03 10:36 aml Assigned To aml => bugmaster
2022-06-03 10:36 aml Status resolved => reviewed
2022-06-03 10:36 aml Note Added: 0108815
2022-06-04 10:12 afokin Test case number => tests/bugs/modalg_8/bug32931
2022-06-04 10:12 afokin Status reviewed => tested
2022-06-04 10:12 afokin Note Added: 0108850
2022-06-04 12:56 afokin Changeset attached => occt master d30f25e6
2022-06-04 12:56 CharlemagneLasse Assigned To bugmaster => CharlemagneLasse
2022-06-04 12:56 CharlemagneLasse Status tested => verified
2022-06-04 12:56 CharlemagneLasse Resolution open => fixed
2022-06-04 12:59 git Note Added: 0108856
2022-06-28 06:34 azv Target Version => 7.6.3