Fix #26203: crash with empty raytree, all types should survive this now.

Also added a check for -inf/inf bounding boxes, just to be sure.

6 files changed, 37 insertions, 15 deletions

diff --git a/source/blender/render/intern/raytrace/bvh.h b/source/blender/render/intern/raytrace/bvh.h
index 56912ad7cdc..3ba5bbc624e 100644
--- a/source/blender/render/intern/raytrace/bvh.h
+++ b/source/blender/render/intern/raytrace/bvh.h
@@ -129,7 +129,8 @@ static void bvh_free(Tree *obj)
 template<class Tree>
 static void bvh_bb(Tree *obj, float *min, float *max)
 {
-	bvh_node_merge_bb(obj->root, min, max);
+	if(obj->root)
+		bvh_node_merge_bb(obj->root, min, max);
 }
 
 
diff --git a/source/blender/render/intern/raytrace/rayobject_qbvh.cpp b/source/blender/render/intern/raytrace/rayobject_qbvh.cpp
index fb23165a6e0..331358f727b 100644
--- a/source/blender/render/intern/raytrace/rayobject_qbvh.cpp
+++ b/source/blender/render/intern/raytrace/rayobject_qbvh.cpp
@@ -80,9 +80,12 @@ void bvh_done<QBVHTree>(QBVHTree *obj)
 		return;
 	}
 	
-	pushup_simd<VBVHNode,4>(root);
-
-	obj->root = Reorganize_SVBVH<VBVHNode>(arena2).transform(root);
+	if(root) {
+		pushup_simd<VBVHNode,4>(root);
+		obj->root = Reorganize_SVBVH<VBVHNode>(arena2).transform(root);
+	}
+	else
+		obj->root = NULL;
 	
 	//Free data
 	BLI_memarena_free(arena1);
diff --git a/source/blender/render/intern/raytrace/rayobject_rtbuild.cpp b/source/blender/render/intern/raytrace/rayobject_rtbuild.cpp
index bcd5cb61608..866178be634 100644
--- a/source/blender/render/intern/raytrace/rayobject_rtbuild.cpp
+++ b/source/blender/render/intern/raytrace/rayobject_rtbuild.cpp
@@ -106,6 +106,13 @@ void rtbuild_add(RTBuilder *b, RayObject *o)
 	INIT_MINMAX(bb, bb+3);
 	RE_rayobject_merge_bb(o, bb, bb+3);
 
+	/* skip objects with inf/nan in bounding boxes. we should not be
+	   getting these, but in case it happens this avoids crashes */
+	if(!finite(bb[0]) || !finite(bb[1]) || !finite(bb[2]))
+		return;
+	if(!finite(bb[3]) || !finite(bb[4]) || !finite(bb[5]))
+		return;
+
 	/* skip objects with zero bounding box, they are of no use, and
 	   will give problems in rtbuild_heuristic_object_split later */
 	if(len_squared_v3v3(bb, bb+3) == 0.0f)
diff --git a/source/blender/render/intern/raytrace/rayobject_svbvh.cpp b/source/blender/render/intern/raytrace/rayobject_svbvh.cpp
index 3a29ac29390..a99c57ab233 100644
--- a/source/blender/render/intern/raytrace/rayobject_svbvh.cpp
+++ b/source/blender/render/intern/raytrace/rayobject_svbvh.cpp
@@ -115,8 +115,12 @@ void bvh_done<SVBVHTree>(SVBVHTree *obj)
 			return;
 		}
 
-		VBVH_optimalPackSIMD<OVBVHNode,PackCost>(PackCost()).transform(root);
-		obj->root = Reorganize_SVBVH<OVBVHNode>(arena2).transform(root);
+		if(root) {
+			VBVH_optimalPackSIMD<OVBVHNode,PackCost>(PackCost()).transform(root);
+			obj->root = Reorganize_SVBVH<OVBVHNode>(arena2).transform(root);
+		}
+		else
+			obj->root = NULL;
 	}
 	
 	//Free data
diff --git a/source/blender/render/intern/raytrace/rayobject_vbvh.cpp b/source/blender/render/intern/raytrace/rayobject_vbvh.cpp
index 1765f3da381..25eada43a4a 100644
--- a/source/blender/render/intern/raytrace/rayobject_vbvh.cpp
+++ b/source/blender/render/intern/raytrace/rayobject_vbvh.cpp
@@ -98,13 +98,17 @@ void bvh_done<VBVHTree>(VBVHTree *obj)
 			return;
 		}
 
-		reorganize(root);
-		remove_useless(root, &root);
-		bvh_refit(root);
-	
-		pushup(root);
-		pushdown(root);
-		obj->root = root;
+		if(root) {
+			reorganize(root);
+			remove_useless(root, &root);
+			bvh_refit(root);
+		
+			pushup(root);
+			pushdown(root);
+			obj->root = root;
+		}
+		else
+			obj->root = NULL;
 	}
 	else
 	{
diff --git a/source/blender/render/intern/raytrace/vbvh.h b/source/blender/render/intern/raytrace/vbvh.h
index d91a7c209c8..62cccdb5af9 100644
--- a/source/blender/render/intern/raytrace/vbvh.h
+++ b/source/blender/render/intern/raytrace/vbvh.h
@@ -157,9 +157,12 @@ struct BuildBinaryVBVH
 	
 	Node *_transform(RTBuilder *builder)
 	{
-		
 		int size = rtbuild_size(builder);
-		if(size == 1)
+
+		if(size == 0) {
+			return NULL;
+		}
+		else if(size == 1)
 		{
 			Node *node = create_node();
 			INIT_MINMAX(node->bb, node->bb+3);