FreeCAD crashes with SIGSEGV when opening a specific file about freecad

[wwmayer]

The crash is caused inside getElementHistory() (defined in ComplexGeoData.h) because the member variable _elementMap is a null pointer.
@bgbsww
How should this be handled? Should it throw an exception or should it return a value (e.g. -1, 0 or whatever) to indicate an error?

[wwmayer]

so a duplicate?

There is no relation as far as I can see.

[maxwxyz]

related? #14254

[xtemp09]

I've opened the test file and got the same backtrace. The backtrace is seriously connected to the one provided by me in here.

The backtrace

Process 1702 stopped
* thread #1, name = 'FreeCAD', stop reason = signal SIGSEGV: address not mapped to object (fault address: 0x88)
    frame #0: 0x00007ffff60a47f5 libFreeCADApp.so`Data::ElementMap::dehashElementName(this=0x0000000000000000, name=0x00007fffffff9810) const at ElementMap.cpp:708:5
   705      if (name.empty()) {
   706          return name;
   707      }
-> 708      if (!this->hasher) {
   709          return name;
   710      }
   711      auto id = App::StringID::fromString(name.toRawBytes());
(lldb) bt
* thread #1, name = 'FreeCAD', stop reason = signal SIGSEGV: address not mapped to object (fault address: 0x88)
  * frame #0: 0x00007ffff60a47f5 libFreeCADApp.so`Data::ElementMap::dehashElementName(this=0x0000000000000000, name=0x00007fffffff9810) const at ElementMap.cpp:708:5
    frame #1: 0x00007ffff60a78fd libFreeCADApp.so`Data::ElementMap::getElementHistory(this=0x0000000000000000, name=0x000055555a604a78, masterTag=742, original=<unavailable>, history=size=0) const at ElementMap.cpp:1338:36
    frame #2: 0x00007fffc313b2aa Part.so`::getElementSource(App::DocumentObject *, Part::TopoShape, const Data::MappedName &, char) [inlined] Data::ComplexGeoData::getElementHistory(history=size=0, original=0x00007fffffff9a90, name=<unavailable>, this=0x00007fffffff9fb0) const at ComplexGeoData.h:299:46
    frame #3: 0x00007fffc313b28f Part.so`getElementSource(owner=<unavailable>, shape=TopoShape @ 0x00007fffffff9fb0, name=0x00007fffffff9dd0, type='F') at PartFeature.cpp:467:43
    frame #4: 0x00007fffc313b514 Part.so`Part::Feature::getRelatedElements(obj=<unavailable>, name=";g15;SKT;:H2da,E;:G;XTR;:H2da:7,F;:H-2dc,F;:H2dc,F;:H2d7,F.Face9", sameType=followTypeChange, withCache=false) at PartFeature.cpp:778:91
    frame #5: 0x00007fffc32cc008 Part.so`Attacher::AttachEngine::calculateAttachedPlacement(this=0x000055555a5a6b70, origPlacement=0x000055555a5a9ed0, subChanged=0x0000000000000000) at Attacher.cpp:971:63
    frame #6: 0x00007fffc3154b36 Part.so`Part::AttachExtension::isAttacherActive(this=0x000055555a5aa1d8) const at AttachExtension.cpp:312:56
    frame #7: 0x00007fffc3157113 Part.so`Part::AttachExtension::extensionOnChanged(this=0x000055555a5aa1d8, prop=0x000055555a5aa378) at AttachExtension.cpp:366:50
    frame #8: 0x00007ffff5eeea12 libFreeCADApp.so`App::ExtensionContainer::onChanged(this=0x000055555a5a99a0, prop=0x000055555a5aa378) at ExtensionContainer.cpp:282:41
    frame #9: 0x00007ffff5ee9bf7 libFreeCADApp.so`App::DocumentObject::onChanged(this=0x000055555a5a99a0, prop=0x000055555a5aa378) at DocumentObject.cpp:818:35
    frame #10: 0x00007ffff5f906fc libFreeCADApp.so`App::GeoFeature::onChanged(this=0x000055555a5a99a0, prop=0x000055555a5aa378) at GeoFeature.cpp:255:30
    frame #11: 0x00007fffc313c13c Part.so`Part::Feature::onChanged(this=0x000055555a5a99a0, prop=0x000055555a5aa378) at PartFeature.cpp:1469:26
    frame #12: 0x00007fffb6fef832 Sketcher.so`Sketcher::SketchObject::onChanged(this=0x000055555a5a99a0, prop=0x000055555a5aa378) at SketchObject.cpp:8938:34
    frame #13: 0x00007ffff5fe12e2 libFreeCADApp.so`App::Property::hasSetValue(this=0x000055555a5aa378) at Property.cpp:230:26
    frame #14: 0x00007ffff60161a6 libFreeCADApp.so`App::PropertyLinkBase::hasSetValue(this=0x000055555a5aa378) at PropertyLinks.cpp:78:26
    frame #15: 0x00007ffff600a5bf libFreeCADApp.so`App::PropertyLinkSubList::setValues(this=0x000055555a5aa378, lValue=size=0, lSubNames=size=0, ShadowSubList=size=0) at PropertyLinks.cpp:2047:16
    frame #16: 0x00007ffff600a658 libFreeCADApp.so`App::PropertyLinkSubList::setValues(this=0x000055555a5aa378, lValue=size=1, lSubNames=size=1, ShadowSubList=size=0) at PropertyLinks.cpp:2001:14
    frame #17: 0x00007ffff600aa85 libFreeCADApp.so`App::PropertyLinkSubList::Paste(this=0x000055555a5aa378, from=0x000055555a5aa268) at PropertyLinks.cpp:2725:14
    frame #18: 0x00007fffc3157250 Part.so`Part::AttachExtension::onExtendedDocumentRestored(this=0x000055555a5aa1d8) at AttachExtension.cpp:399:36
    frame #19: 0x00007ffff5ee7279 libFreeCADApp.so`App::DocumentObject::onDocumentRestored(this=0x000055555a5a99a0) at DocumentObject.cpp:1121:40
    frame #20: 0x00007fffb6fd71a0 Sketcher.so`Sketcher::SketchObject::onDocumentRestored(this=0x000055555a5a99a0) at SketchObject.cpp:9050:47
    frame #21: 0x00007ffff5e7dea1 libFreeCADApp.so`App::Document::afterRestore(this=0x0000555558d0f340, objArray=<unavailable>, checkPartial=<unavailable>) at Document.cpp:2172:36
    frame #22: 0x00007ffff5e7f3a1 libFreeCADApp.so`App::Document::afterRestore(this=0x0000555558d0f340, checkPartial=<unavailable>) at Document.cpp:2116:21
    frame #23: 0x00007ffff606578b libFreeCADApp.so`App::Application::openDocuments(this=0x0000555555718530, filenames=size=1, paths=size=0, labels=size=0, errs=size=0, createView=<unavailable>) at Application.cpp:885:33
    frame #24: 0x00007ffff6066275 libFreeCADApp.so`App::Application::openDocument(this=0x0000555555718530, FileName=<unavailable>, createView=<unavailable>) at Application.cpp:684:79
    frame #25: 0x00007ffff6083164 libFreeCADApp.so`App::Application::sOpenDocument((null)=<unavailable>, args=<unavailable>, kwd=<unavailable>) at ApplicationPy.cpp:263:46
    frame #26: 0x00007ffff5128023 libpython3.10.so.1.0`___lldb_unnamed_symbol3713 + 99
    frame #27: 0x00007ffff50dfadc libpython3.10.so.1.0`_PyObject_MakeTpCall + 140
    frame #28: 0x00007ffff507ba1c libpython3.10.so.1.0`_PyEval_EvalFrameDefault + 40380
    frame #29: 0x00007ffff51c23af libpython3.10.so.1.0`___lldb_unnamed_symbol4418 + 1647
    frame #30: 0x00007ffff51bd3de libpython3.10.so.1.0`PyEval_EvalCode + 190
    frame #31: 0x00007ffff520c4cd libpython3.10.so.1.0`___lldb_unnamed_symbol4668 + 157
    frame #32: 0x00007ffff520d4f9 libpython3.10.so.1.0`PyRun_StringFlags + 121
    frame #33: 0x00007ffff578dab1 libFreeCADBase.so`Base::InterpreterSingleton::runString[abi:cxx11](this=<unavailable>, sCmd="FreeCAD.openDocument('/home/xtemp09/Downloads/TD-crash/test/bird_home_holder.FCStd')") at Interpreter.cpp:249:15
    frame #34: 0x00007ffff6d50e5c libFreeCADGui.so`Gui::Command::_runCommand(file="/home/xtemp09/Downloads/FreeCAD2/freecad-source/src/Gui/Application.cpp", line=597, eType=App, sCmd="FreeCAD.openDocument('/home/xtemp09/Downloads/TD-crash/test/bird_home_holder.FCStd')") at Command.cpp:725:38
    frame #35: 0x00007ffff6d5101a libFreeCADGui.so`Gui::Command::_doCommand(file="/home/xtemp09/Downloads/FreeCAD2/freecad-source/src/Gui/Application.cpp", line=597, eType=App, sCmd=<unavailable>) at Command.cpp:677:16
    frame #36: 0x00007ffff6c67b46 libFreeCADGui.so`Gui::Application::open(this=<unavailable>, FileName=<unavailable>, Module=<unavailable>) at Application.cpp:597:30
    frame #37: 0x00007ffff6d623fc libFreeCADGui.so`StdCmdOpen::activated(this=<unavailable>, iMsg=<unavailable>) at CommandDoc.cpp:158:38
    frame #38: 0x00007ffff6d56682 libFreeCADGui.so`Gui::Command::_invoke(this=0x0000555555b79a20, id=0, disablelog=<unavailable>) at Command.cpp:444:26
    frame #39: 0x00007ffff6d56cf2 libFreeCADGui.so`Gui::Command::invoke(this=0x0000555555b79a20, i=0, trigger=TriggerAction) at Command.cpp:408:12
    frame #40: 0x00007ffff6d41933 libFreeCADGui.so`Gui::Action::onActivated(this=<unavailable>) at Action.cpp:111:22
    frame #41: 0x00007ffff6d4b8ba libFreeCADGui.so`QtPrivate::FunctorCall<QtPrivate::IndexesList<>, QtPrivate::List<>, void, void (Gui::Action::*)()>::call(f=<unavailable>, o=<unavailable>, arg=<unavailable>) at qobjectdefs_impl.h:152:20
    frame #42: 0x00007ffff6d4b8f8 libFreeCADGui.so`QtPrivate::QSlotObject<void (Gui::Action::*)(), QtPrivate::List<>, void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*) [inlined] void QtPrivate::FunctionPointer<void (Gui::Action::*)()>::call<QtPrivate::List<>, void>(arg=<unavailable>, o=<unavailable>, f=<unavailable>) at qobjectdefs_impl.h:185:95
    frame #43: 0x00007ffff6d4b8f0 libFreeCADGui.so`QtPrivate::QSlotObject<void (Gui::Action::*)(), QtPrivate::List<>, void>::impl(which=<unavailable>, this_=<unavailable>, r=<unavailable>, a=<unavailable>, ret=<unavailable>) at qobjectdefs_impl.h:418:49
    frame #44: 0x00007ffff3ee33db libQt5Core.so.5`void doActivate<false>(QObject*, int, void**) [inlined] QtPrivate::QSlotObjectBase::call(a=0x00007fffffffbf70, r=0x0000555556c12620, this=0x0000555556c131e0) at qobjectdefs_impl.h:398:57
    frame #45: 0x00007ffff3ee33bf libQt5Core.so.5`void doActivate<false>(sender=0x0000555556c13010, signal_index=4, argv=0x00007fffffffbf70) at qobject.cpp:3925:30
    frame #46: 0x00007ffff3eda3ab libQt5Core.so.5`QMetaObject::activate(sender=<unavailable>, m=0x000000000071a2c0, local_signal_index=1, argv=0x00007fffffffbf70) at qobject.cpp:3985:26
    frame #47: 0x00007ffff4ad96c8 libQt5Widgets.so.5`QAction::triggered(this=<unavailable>, _t1=<unavailable>) at moc_qaction.cpp:376:26
    frame #48: 0x00007ffff4adcb8b libQt5Widgets.so.5`QAction::activate(this=0x0000555556c13010, event=Trigger) at qaction.cpp:1161:27
    frame #49: 0x00007ffff4c9d912 libQt5Widgets.so.5`QMenuPrivate::activateCausedStack(this=0x000055555855d9e0, causedStack=0x00007fffffffc088, action=0x0000555556c13010, action_e=Trigger, self=true) at qmenu.cpp:1384:25
    frame #50: 0x00007ffff4ca548e libQt5Widgets.so.5`QMenuPrivate::activateAction(this=0x000055555855d9e0, action=0x0000555556c13010, action_e=Trigger, self=true) at qmenu.cpp:1461:24
    frame #51: 0x00007ffff4ca6754 libQt5Widgets.so.5`QMenu::mouseReleaseEvent(this=<unavailable>, e=0x00007fffffffc870) at qmenu.cpp:2967:34
    frame #52: 0x00007ffff4b2d919 libQt5Widgets.so.5`QWidget::event(this=0x00005555585e92e0, event=0x00007fffffffc870) at qwidget.cpp:8671:26
    frame #53: 0x00007ffff4ca8f10 libQt5Widgets.so.5`QMenu::event(this=0x00005555585e92e0, e=0x00007fffffffc870) at qmenu.cpp:3089:26
    frame #54: 0x00007ffff4ae1813 libQt5Widgets.so.5`QApplicationPrivate::notify_helper(this=<unavailable>, receiver=0x00005555585e92e0, e=0x00007fffffffc870) at qapplication.cpp:3640:31
    frame #55: 0x00007ffff4aea60a libQt5Widgets.so.5`QApplication::notify(this=<unavailable>, receiver=0x00005555585e92e0, e=0x00007fffffffc870) at qapplication.cpp:3084:43
    frame #56: 0x00007ffff6d19982 libFreeCADGui.so`Gui::GUIApplication::notify(this=0x00007fffffffd7c0, receiver=0x00005555585e92e0, event=0x00007fffffffc870) at GuiApplication.cpp:83:40
    frame #57: 0x00007ffff3e9ef19 libQt5Core.so.5`QCoreApplication::notifyInternal2(receiver=0x00005555585e92e0, event=0x00007fffffffc870) at qcoreapplication.cpp:1064:24
    frame #58: 0x00007ffff3e9f1b4 libQt5Core.so.5`QCoreApplication::sendSpontaneousEvent(receiver=0x00005555585e92e0, event=0x00007fffffffc870) at qcoreapplication.cpp:1474:27
    frame #59: 0x00007ffff4ae937b libQt5Widgets.so.5`QApplicationPrivate::sendMouseEvent(receiver=0x00005555585e92e0, event=0x00007fffffffc870, alienWidget=0x0000000000000000, nativeWidget=0x00005555585e92e0, buttonDown=0x00007ffff4f4d470, lastMouseReceiver=0x00007ffff4f4d450, spontaneous=true, onlyDispatchEnterLeave=false) at qapplication.cpp:2622:56
    frame #60: 0x00007ffff4b4b34c libQt5Widgets.so.5`QWidgetWindow::handleMouseEvent(this=0x0000555555ed3270, event=0x00007fffffffced0) at qwidgetwindow.cpp:580:52
    frame #61: 0x00007ffff4b4e83a libQt5Widgets.so.5`QWidgetWindow::event(this=0x0000555555ed3270, event=0x00007fffffffced0) at qwidgetwindow.cpp:300:25
    frame #62: 0x00007ffff4ae1813 libQt5Widgets.so.5`QApplicationPrivate::notify_helper(this=0x00005555559002a0, receiver=0x0000555555ed3270, e=0x00007fffffffced0) at qapplication.cpp:3640:31
    frame #63: 0x00007ffff4aea1be libQt5Widgets.so.5`QApplication::notify(this=0x00007fffffffd7c0, receiver=0x0000555555ed3270, e=0x00007fffffffced0) at qapplication.cpp:2980:31
    frame #64: 0x00007ffff6d19982 libFreeCADGui.so`Gui::GUIApplication::notify(this=0x00007fffffffd7c0, receiver=0x0000555555ed3270, event=0x00007fffffffced0) at GuiApplication.cpp:83:40
    frame #65: 0x00007ffff3e9ef19 libQt5Core.so.5`QCoreApplication::notifyInternal2(receiver=0x0000555555ed3270, event=0x00007fffffffced0) at qcoreapplication.cpp:1064:24
    frame #66: 0x00007ffff3e9f1b4 libQt5Core.so.5`QCoreApplication::sendSpontaneousEvent(receiver=<unavailable>, event=<unavailable>) at qcoreapplication.cpp:1474:27
    frame #67: 0x00007ffff4231971 libQt5Gui.so.5`QGuiApplicationPrivate::processMouseEvent(e=0x0000555555d66c10) at qguiapplication.cpp:2285:42
    frame #68: 0x00007ffff4233366 libQt5Gui.so.5`QGuiApplicationPrivate::processWindowSystemEvent(e=0x0000555555d66c10) at qguiapplication.cpp:2005:50
    frame #69: 0x00007ffff420d0c8 libQt5Gui.so.5`QWindowSystemInterface::sendWindowSystemEvents(flags=(i = 36)) at qwindowsysteminterface.cpp:1169:61
    frame #70: 0x00007fffee068466 libQt5XcbQpa.so.5`xcbSourceDispatch(source=<unavailable>, (null)=<unavailable>, (null)=<unavailable>) at qxcbeventdispatcher.cpp:105:51
    frame #71: 0x00007ffff311bd3b libglib-2.0.so.0`g_main_context_dispatch + 619
    frame #72: 0x00007ffff31712b8 libglib-2.0.so.0`___lldb_unnamed_symbol2709 + 488
    frame #73: 0x00007ffff31193e3 libglib-2.0.so.0`g_main_context_iteration + 51
    frame #74: 0x00007ffff3f0bfbf libQt5Core.so.5`QEventDispatcherGlib::processEvents(this=0x0000555555835b60, flags=(i = 36)) at qeventdispatcher_glib.cpp:423:43
    frame #75: 0x00007fffee068826 libQt5XcbQpa.so.5`QXcbGlibEventDispatcher::processEvents(this=<unavailable>, flags=<unavailable>) at qxcbeventdispatcher.cpp:143:47
    frame #76: 0x00007ffff3e9c89b libQt5Core.so.5`QEventLoop::processEvents(this=0x00007fffffffd2c0, flags=<unavailable>) at qeventloop.cpp:142:68
    frame #77: 0x00007ffff3e9cf3c libQt5Core.so.5`QEventLoop::exec(this=0x00007fffffffd2c0, flags=(i = 0)) at qeventloop.cpp:235:22
    frame #78: 0x00007ffff3ea78df libQt5Core.so.5`QCoreApplication::exec() at qcoreapplication.cpp:1375:36
    frame #79: 0x00007ffff4224a24 libQt5Gui.so.5`QGuiApplication::exec() at qguiapplication.cpp:1870:34
    frame #80: 0x00007ffff4ae177d libQt5Widgets.so.5`QApplication::exec() at qapplication.cpp:2832:33
    frame #81: 0x00007ffff6c6d03b libFreeCADGui.so`(anonymous namespace)::tryRunEventLoop(mainApp=0x00007fffffffd7c0) at Application.cpp:2042:23
    frame #82: 0x00007ffff6c6d304 libFreeCADGui.so`(anonymous namespace)::runEventLoop(mainApp=0x00007fffffffd7c0) at Application.cpp:2062:24
    frame #83: 0x00007ffff6c7117e libFreeCADGui.so`Gui::Application::runApplication() at Application.cpp:2139:17
    frame #84: 0x000055555556a3a5 FreeCAD`main(argc=<unavailable>, argv=<unavailable>) at MainGui.cpp:278:45
    frame #85: 0x00007ffff3229d90 libc.so.6`__libc_start_call_main(main=(FreeCAD`main at MainGui.cpp:105:1), argc=1, argv=0x00007fffffffdd98) at libc_start_call_main.h:58:16
    frame #86: 0x00007ffff3229e40 libc.so.6`__libc_start_main_impl(main=(FreeCAD`main at MainGui.cpp:105:1), argc=1, argv=0x00007fffffffdd98, init=<unavailable>, fini=<unavailable>, rtld_fini=<unavailable>, stack_end=0x00007fffffffdd88) at libc-start.c:392:3
    frame #87: 0x0000555555569c05 FreeCAD`_start + 37
(lldb)

OS: Ubuntu 22.04.3 LTS (KDE/plasma)
Word size of FreeCAD: 64-bit
Version: 0.22.0dev.37464 (Git)
Build type: Debug
Branch: main
Hash: db48a78d5a545bb21a5c80a9fa4b4c983fbbe951
Python 3.10.12, Qt 5.15.12, Coin 4.0.0, Vtk 9.1.0, OCC 7.5.1
Locale: English/United States (en_US)

[maxwxyz]

so a duplicate?

[xtemp09]

The issue #14254 was created with the backtrace different from the one provided in here. Possibly, the issues are not related at all.

[bgbsww]

In general, _elementMap was refactored out into a separate object, and its original initialization that occurred in SetElementName now sometimes has to be done elsewhere; there is an idiomatic code snippet:

                // Originally in ComplexGeoData::setElementName
                // LinkStable/src/App/ComplexGeoData.cpp#L1631
                // No longer possible after map separated in ElementMap.cpp

                if (!elementMap()) {
                    resetElementMap(std::make_shared<Data::ElementMap>());
                }

So in the original TNP code, this case is impossible because there is no pointer to be null.
This seems to be a case where history is being called on a shape that never had the _elementMap initialized. We just force the _elementMap to be initialized and empty everywhere else, but it would be useful to understand how this happens in case there's another issue related to it. I'm going to go look at that now ...

... yeah, I'm worried that maybe this is caused by a missing code path during the file restore, and I need to check that. Adding a null defense in the history call would certainly solve this, but might not reveal another problem. Looking ...

... Okay, I don't think that code ( in the Sketcher/SketchObject.cpp mess ) should come over, so the fix is likely to force the initialization. Was this file created with one of the TNP versions of the code? Duh, Document.xml says this was created with one of the TNP versions. There is a possibility that the code for SketchObject::Save, SketchObject::restoreFinished, SketchObject::updateGeometryRefs and others needs to come over, but that changes some of the instance variables and ultimately hauls in dozens of methods. So, fixing the immediate crash without going to that extent is attractive. Thus the submitted PR.