From bcde045b32af9fcbb68ea616da5c6a4df81f7582 Mon Sep 17 00:00:00 2001 From: Campbell Barton Date: Fri, 17 Jun 2016 21:45:56 +1000 Subject: Fix T48667: Bisect-fill crash BMO iterator would loop over removed faces. Recent changes to mempool FREEWORD size exposed this bug. --- source/blender/bmesh/operators/bmo_triangulate.c | 38 +++++++++++++----------- 1 file changed, 21 insertions(+), 17 deletions(-) (limited to 'source/blender/bmesh/operators/bmo_triangulate.c') diff --git a/source/blender/bmesh/operators/bmo_triangulate.c b/source/blender/bmesh/operators/bmo_triangulate.c index 6fb09c76ea4..974446f09c0 100644 --- a/source/blender/bmesh/operators/bmo_triangulate.c +++ b/source/blender/bmesh/operators/bmo_triangulate.c @@ -244,29 +244,33 @@ void bmo_triangle_fill_exec(BMesh *bm, BMOperator *op) BMO_slot_buffer_flag_enable(bm, bmop.slots_out, "geom.out", BM_FACE | BM_EDGE, ELE_NEW); BMO_op_finish(bm, &bmop); } - - BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW); if (use_dissolve) { - BMO_ITER (e, &siter, op->slots_out, "geom.out", BM_EDGE) { - if (LIKELY(e->l)) { /* in rare cases the edges face will have already been removed from the edge */ - BMFace *f_new; - f_new = BM_faces_join_pair(bm, e->l->f, - e->l->radial_next->f, e, - false); /* join faces */ - if (f_new) { - BMO_elem_flag_enable(bm, f_new, ELE_NEW); - BM_edge_kill(bm, e); + BMEdge *e_next; + BMIter iter; + + BM_ITER_MESH_MUTABLE (e, e_next, &iter, bm, BM_EDGES_OF_MESH) { + if (BMO_elem_flag_test(bm, e, ELE_NEW)) { + /* in rare cases the edges face will have already been removed from the edge */ + if (LIKELY(e->l)) { + BMFace *f_new = BM_faces_join_pair( + bm, e->l->f, + e->l->radial_next->f, e, + false); /* join faces */ + if (f_new) { + BMO_elem_flag_enable(bm, f_new, ELE_NEW); + BM_edge_kill(bm, e); + } + else { + BMO_error_clear(bm); + } } else { - BMO_error_clear(bm); + BM_edge_kill(bm, e); } } - else { - BM_edge_kill(bm, e); - } } - - BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW); } + + BMO_slot_buffer_from_enabled_flag(bm, op, op->slots_out, "geom.out", BM_EDGE | BM_FACE, ELE_NEW); } -- cgit v1.2.3