From c81c15b74137e1471c6c1d95c421d3d69fe99fd4 Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <andreykproductengine@lindenlab.com>
Date: Thu, 23 Nov 2023 21:22:02 +0200
Subject: SL-18875 Crash at LLModel::writeModel

Looks like a crash iterating over
weight_list& weights = model[idx]->getJointInfluences(pos);
---
 indra/llprimitive/llmodel.cpp | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

(limited to 'indra/llprimitive/llmodel.cpp')

diff --git a/indra/llprimitive/llmodel.cpp b/indra/llprimitive/llmodel.cpp
index fbd97b3de7..153b9a1d23 100644
--- a/indra/llprimitive/llmodel.cpp
+++ b/indra/llprimitive/llmodel.cpp
@@ -997,7 +997,12 @@ LLModel::weight_list& LLModel::getJointInfluences(const LLVector3& pos)
 	weight_map::iterator iterPos = mSkinWeights.begin();
 	weight_map::iterator iterEnd = mSkinWeights.end();
 
-    llassert(!mSkinWeights.empty());
+    if (mSkinWeights.empty())
+    {
+        // function calls iter->second on all return paths
+        // everything that calls this function should precheck that there is data.
+        LL_ERRS() << "called getJointInfluences with empty weights list" << LL_ENDL;
+    }
 	
 	for ( ; iterPos!=iterEnd; ++iterPos )
 	{
@@ -1024,11 +1029,16 @@ LLModel::weight_list& LLModel::getJointInfluences(const LLVector3& pos)
 		const F32 epsilon = 1e-5f;
 		weight_map::iterator iter_up = mSkinWeights.lower_bound(pos);
 		weight_map::iterator iter_down = iter_up;
-		if (iter_up != mSkinWeights.end())
-		{
-			iter_down = ++iter_up;
-		}
-		weight_map::iterator best = iter_up;
+        weight_map::iterator best = iter_up;
+        if (iter_up != mSkinWeights.end())
+        {
+            iter_down = ++iter_up;
+        }
+        else
+        {
+            // Assumes that there is at least one element
+            --best;
+        }
 
 		F32 min_dist = (iter->first - pos).magVec();
 
-- 
cgit v1.3


From 8ea1f4a3fc77145cb60a7b8182e0da9c0e43ed69 Mon Sep 17 00:00:00 2001
From: Andrey Kleshchev <andreykproductengine@lindenlab.com>
Date: Thu, 14 Dec 2023 22:51:18 +0200
Subject: SL-15628 Crash inside ~LLModelInstanceBase

More explicit cleanup in hopes of narrowing down which of the models
failed
---
 indra/llmath/llvolume.h          |  2 +-
 indra/llprimitive/llmodel.cpp    |  1 +
 indra/llprimitive/llmodel.h      | 16 +++++++++++++++-
 indra/newview/llmodelpreview.cpp | 10 ++++++++++
 indra/newview/llmodelpreview.h   |  1 -
 5 files changed, 27 insertions(+), 3 deletions(-)

(limited to 'indra/llprimitive/llmodel.cpp')

diff --git a/indra/llmath/llvolume.h b/indra/llmath/llvolume.h
index afed98ff36..71878b8cb6 100644
--- a/indra/llmath/llvolume.h
+++ b/indra/llmath/llvolume.h
@@ -1000,7 +1000,7 @@ class LLVolume : public LLRefCount
 	friend class LLVolumeLODGroup;
 
 protected:
-	~LLVolume(); // use unref
+	virtual ~LLVolume(); // use unref
 
 public:
 	typedef std::vector<LLVolumeFace> face_list_t;
diff --git a/indra/llprimitive/llmodel.cpp b/indra/llprimitive/llmodel.cpp
index ee493968de..68a7f29378 100644
--- a/indra/llprimitive/llmodel.cpp
+++ b/indra/llprimitive/llmodel.cpp
@@ -67,6 +67,7 @@ LLModel::~LLModel()
 	{
 		LLConvexDecomposition::getInstance()->deleteDecomposition(mDecompID);
 	}
+    mPhysics.mMesh.clear();
 }
 
 //static
diff --git a/indra/llprimitive/llmodel.h b/indra/llprimitive/llmodel.h
index 4505d6b3b9..040257e00e 100644
--- a/indra/llprimitive/llmodel.h
+++ b/indra/llprimitive/llmodel.h
@@ -106,6 +106,8 @@ public:
 		std::vector<LLVector3> mPositions;
 		std::vector<LLVector3> mNormals;
 
+        ~PhysicsMesh() {}
+
 		void clear()
 		{
 			mPositions.clear();
@@ -131,6 +133,7 @@ public:
 	public:
 		Decomposition() { }
 		Decomposition(LLSD& data);
+		~Decomposition() { }
 		void fromLLSD(LLSD& data);
 		LLSD asLLSD() const;
 		bool hasHullList() const;
@@ -365,7 +368,7 @@ class LLModelInstanceBase
 {
 public:
 	LLPointer<LLModel> mModel;
-	LLPointer<LLModel> mLOD[5];
+	LLPointer<LLModel> mLOD[LLModel::NUM_LODS];
 	LLUUID mMeshID;
 
 	LLMatrix4 mTransform;
@@ -380,6 +383,15 @@ public:
 		: mModel(NULL)
 	{
 	}
+
+    virtual ~LLModelInstanceBase()
+    {
+        mModel = NULL;
+        for (int j = 0; j < LLModel::NUM_LODS; ++j)
+        {
+            mLOD[j] = NULL;
+        }
+    };
 };
 
 typedef std::vector<LLModelInstanceBase> model_instance_list;
@@ -399,6 +411,8 @@ public:
 
 	LLModelInstance(LLSD& data);
 
+    ~LLModelInstance() {}
+
 	LLSD asLLSD();
 };
 
diff --git a/indra/newview/llmodelpreview.cpp b/indra/newview/llmodelpreview.cpp
index ccae1030f1..ad22e84c6e 100644
--- a/indra/newview/llmodelpreview.cpp
+++ b/indra/newview/llmodelpreview.cpp
@@ -220,6 +220,16 @@ LLModelPreview::~LLModelPreview()
         mPreviewAvatar->markDead();
         mPreviewAvatar = NULL;
     }
+
+    mUploadData.clear();
+    mTextureSet.clear();
+
+    for (U32 i = 0; i < LLModel::NUM_LODS; i++)
+    {
+        clearModel(i);
+    }
+    mBaseModel.clear();
+    mBaseScene.clear();
 }
 
 void LLModelPreview::updateDimentionsAndOffsets()
diff --git a/indra/newview/llmodelpreview.h b/indra/newview/llmodelpreview.h
index df7320768c..d4d5d087bd 100644
--- a/indra/newview/llmodelpreview.h
+++ b/indra/newview/llmodelpreview.h
@@ -310,7 +310,6 @@ protected:
     vv_LLVolumeFace_t mBaseModelFacesCopy;
 
     U32 mGroup;
-    std::map<LLPointer<LLModel>, U32> mObject;
 
     // Amount of triangles in original(base) model
     U32 mMaxTriangleLimit;
-- 
cgit v1.3