[Fixed] Crash when typing expressions

[DeepSOIC]

1. Open attached file.

link-part-multinesting.FCStd

(14.74 KiB) Downloaded 43 times

2. Locate "Link (to Part)" object (in Part001).
3. expand Placement property, click f(x) on angle value.
4. type "Sketch.Placement.Angle"
The moment I type letter "g", FreeCAD closes itself. Before typing "g", I see an error message "Illegal storage access" something something.

It may have been fixed in this PR, as there are some changes to expression parser and autocompleter.
https://github.com/FreeCAD/FreeCAD/pull/2449
But I haven't tested.

OS: Windows 10 (10.0)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.17803 (Git)
Build type: Release
Branch: master
Hash: 89961a33d46063a43e9fb5b0308ca95d559eca94
Python version: 3.6.8
Qt version: 5.12.1
Coin version: 4.0.0a
OCC version: 7.3.0
Locale: Russian/Russia (ru_RU)

[user1234]

Hello!

Yes, crashes after i type "Sketch.Placement.A":

Code: Select all

OS: Debian GNU/Linux 10 (buster) (X-Cinnamon/lightdm-xsession)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.17903 (Git)
Build type: DebWithRelInfo
Branch: LinkMerge
Hash: c4850ab220000e96733fa98e86720c354b05a6d0
Python version: 3.7.3
Qt version: 5.11.3
Coin version: 4.0.0a
OCC version: 7.3.0
Locale: English/UnitedStates (en_US)

_expression_crash.webm

(736.19 KiB) Downloaded 33 times

Code: Select all

Program received signal SIGSEGV, Segmentation fault.
#0  /lib/x86_64-linux-gnu/libc.so.6(+0x37840) [0x7f6340c58840]
#1  0x7f6344cca432 in App::ObjectIdentifier::Component::get(Py::Object const&) const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0x482
#2  0x7f6344cd0777 in App::ObjectIdentifier::access(App::ObjectIdentifier::ResolveResults const&, Py::Object*) const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0x126f
#3  0x7f6344cd0d62 in App::ObjectIdentifier::getValue(bool, bool*) const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0x194
#4  0x7f6344cd6644 in App::Property::getPathValue(App::ObjectIdentifier const&) const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0x2e
#5  0x7f6344cf3c17 in App::PropertyPlacement::getPathValue(App::ObjectIdentifier const&) const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0x1cd
#6  0x7f6344c3505c in App::VariableExpression::eval() const from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADApp.so+0xd6
#7  0x7f6346097f03 in Gui::Dialog::DlgExpressionInput::textChanged(QString const&) from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so+0x28d
#8  /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so(+0xffa718) [0x7f6346098718]
#9  0x7f6341601906 in QMetaObject::activate(QObject*, int, int, void**) from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x766
#10  0x7f6342088d52 in QLineEdit::textChanged(QString const&) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x32
#11  /lib/x86_64-linux-gnu/libQt5Widgets.so.5(+0x299609) [0x7f634208f609]
#12  0x7f6341601906 in QMetaObject::activate(QObject*, int, int, void**) from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x766
#13  0x7f6342090165 in QWidgetLineControl::textChanged(QString const&) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x35
#14  0x7f63420934ce in QWidgetLineControl::finishChange(int, bool, bool) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x28e
#15  0x7f634209677e in QWidgetLineControl::processKeyEvent(QKeyEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0xe6e
#16  0x7f6342088eaa in QLineEdit::keyPressEvent(QKeyEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1a
#17  0x7f6345fabce8 in Gui::ExpressionLineEdit::keyPressEvent(QKeyEvent*) from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so+0x40
#18  0x7f6341f93ba7 in QWidget::event(QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x7f7
#19  0x7f634208eeba in QLineEdit::event(QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0xaa
#20  0x7f6341f554b1 in QApplicationPrivate::notify_helper(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x81
#21  0x7f6341f5d8b1 in QApplication::notify(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1171
#22  0x7f6345fb070d in Gui::GUIApplication::notify(QObject*, QEvent*) from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so+0xff
#23  0x7f63415d85a9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x179
#24  /lib/x86_64-linux-gnu/libQt5Widgets.so.5(+0x1bab89) [0x7f6341fb0b89]
#25  0x7f6341f554b1 in QApplicationPrivate::notify_helper(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x81
#26  0x7f6341f5c950 in QApplication::notify(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x210
#27  0x7f6345fb070d in Gui::GUIApplication::notify(QObject*, QEvent*) from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so+0xff
#28  0x7f63415d85a9 in QCoreApplication::notifyInternal2(QObject*, QEvent*) from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x179
#29  0x7f6341982578 in QGuiApplicationPrivate::processKeyEvent(QWindowSystemInterfacePrivate::KeyEvent*) from /lib/x86_64-linux-gnu/libQt5Gui.so.5+0x168
#30  0x7f6341987e05 in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) from /lib/x86_64-linux-gnu/libQt5Gui.so.5+0x115
#31  0x7f634196206b in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) from /lib/x86_64-linux-gnu/libQt5Gui.so.5+0xab
#32  /lib/x86_64-linux-gnu/libQt5XcbQpa.so.5(+0xdd3eb) [0x7f633bb1a3eb]
#33  0x7f63415d727b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x13b
#34  0x7f63415df262 in QCoreApplication::exec() from /lib/x86_64-linux-gnu/libQt5Core.so.5+0x92
#35  0x7f6345e9ccab in Gui::Application::runApplication() from /home/pc/Programs/FreeCAD_Link/lib/libFreeCADGui.so+0x228f
#36  ./FreeCAD(main+0xae7) [0x555e349ab0d6]
#37  /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f6340c4509b]
#38  ./FreeCAD(_start+0x2a) [0x555e349aa4ba]

But i have seen more bugs and crashes in the expressions. I will report them soon.

Greetings
user

[realthunder]

Hello!

Yes, crashes after i type "Sketch.Placement.A":

Are you experiencing the crash after sync with my branch? Hmm... I can't reproduce it. Maybe Python3 related? Seems unlikely. I'll get a Python3 build and see.

[paullee]

Something similar ?

FreeCAD_0.19-17798-Linux-Conda_Py3Qt5_glibc2.12-x86_64.AppImage
on
Fedora

Inputting in Rotation expression something like Sketch.Placement.a .... FC crashes

Haven't tried to retry and record reproducible steps then I see this thread. Same problem?

[realthunder]

Yes, I can reproduce this with Python3. Looks like something "not so right" with PyCXX for Python3, calling getAttr() without checking hasAttr() cause crash in Python3, but not Python2. I would expect an exception. Anyway, I've already pushed a fix.

[DeepSOIC]

Looks like something "not so right" with PyCXX for Python3, calling getAttr() without checking hasAttr() cause crash in Python3, but not Python2. I would expect an exception.

Code: Select all

>>> getattr(App.ActiveDocument.Box.Placement, 'Ang')
Traceback (most recent call last):
  File "<input>", line 1, in <module>
AttributeError: 'Base.Placement' object has no attribute 'Ang'
>>> 

OS: Windows 10 (10.0)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.17803 (Git)
Build type: Release
Branch: master
Hash: 89961a33d46063a43e9fb5b0308ca95d559eca94
Python version: 3.6.8
Qt version: 5.12.1
Coin version: 4.0.0a
OCC version: 7.3.0
Locale: Russian/Russia (ru_RU)

[DeepSOIC]

calling getAttr() without checking hasAttr() cause crash

Especially strange considering python's hasattr is actualy implemented by trying getattr and returning false if AttributeError is raied.
https://gist.github.com/taozle/f3b3d903 ... 8ea89c66b7

Code: Select all

static PyObject *
builtin_hasattr_impl(PyObject *module, PyObject *obj, PyObject *name)
{
    PyObject *v;

    if (!PyUnicode_Check(name)) {
        PyErr_SetString(PyExc_TypeError,
                        "hasattr(): attribute name must be string");
        return NULL;
    }
    v = PyObject_GetAttr(obj, name);
    if (v == NULL) {
        if (PyErr_ExceptionMatches(PyExc_AttributeError)) {
            PyErr_Clear();
            Py_RETURN_FALSE;
        }
        return NULL;
    }
    Py_DECREF(v);
    Py_RETURN_TRUE;
}

[realthunder]

Especially strange considering python's hasattr is actualy implemented by trying getattr and returning false if AttributeError is raied.

What I meant is PyCXX, the C++ wrapper FC is using for Python, the Py::Object stuff. I check the code, it seems Python2 and Python3 wrapper code for getAttr part is identical. A debug build will catch the actual location of the crash quit easily, which I didn't do. I am still a bit reluctant to upgrade my ubuntu.

[TheMarkster]

This is the call stack from a debug build on vs2017

Code: Select all

>	FreeCADApp_d.dll!App::ObjectIdentifier::Component::get(const Py::Object & pyobj) Line 621	C++
 	FreeCADApp_d.dll!App::ObjectIdentifier::access(const App::ObjectIdentifier::ResolveResults & result, Py::Object * value) Line 1634	C++
 	FreeCADApp_d.dll!App::ObjectIdentifier::getValue(bool pathValue, bool * isPseudoProperty) Line 1675	C++
 	FreeCADApp_d.dll!App::Property::getPathValue(const App::ObjectIdentifier & path) Line 128	C++
 	FreeCADApp_d.dll!App::PropertyPlacement::getPathValue(const App::ObjectIdentifier & path) Line 668	C++
 	FreeCADApp_d.dll!App::VariableExpression::eval() Line 2096	C++
 	FreeCADGui_d.dll!Gui::Dialog::DlgExpressionInput::textChanged(const QString & text) Line 136	C++
 	FreeCADGui_d.dll!Gui::Dialog::DlgExpressionInput::qt_static_metacall(QObject * _o, QMetaObject::Call _c, int _id, void * * _a) Line 76	C++

Code: Select all

Py::Object ObjectIdentifier::Component::get(const Py::Object &pyobj) const {
    Py::Object res;
    if(isSimple()) {
        res = pyobj.getAttr(getName());
    } else if(isArray()) {
        if(pyobj.isMapping())
            res = Py::Mapping(pyobj).getItem(Py::Int(begin));
        else
            res = Py::Sequence(pyobj).getItem(begin);
    }else if(isMap())
        res = Py::Mapping(pyobj).getItem(getName());
    else {
        assert(isRange());
        Py::Object slice(PySlice_New(Py::Int(begin).ptr(),
                                    end!=INT_MAX?Py::Int(end).ptr():0,
                                    step!=1?Py::Int(step).ptr():0));
        PyObject *r = PyObject_GetItem(pyobj.ptr(),slice.ptr());
        if(!r)
            Base::PyException::ThrowException();
        res = Py::asObject(r);
    }
    if(PyModule_Check(res.ptr()) && !ExpressionParser::isModuleImported(res.ptr()))
        FC_THROWM(Base::RuntimeError, "Module '" << getName() << "' access denied."); // --> exception thrown here
    return res;
}

OS: Windows 10 (10.0)
Word size of OS: 64-bit
Word size of FreeCAD: 64-bit
Version: 0.19.17887 (Git)
Build type: Debug
Branch: master
Hash: e6e94075518efaad2ccd3a2a3feda9682144c5c7
Python version: 3.6.8
Qt version: 5.12.1
Coin version: 4.0.0a
OCC version: 7.3.0
Locale: English/United States (en_US)

[realthunder]

This is the call stack from a debug build on vs2017

Ah, I see the actual crash site. Thanks!