I've been seeing this crash bug on my machine for a few months, repro steps are unstable and usually involve me picking up one bone on my an armature attached to my mesh then wildly moving the mouse for minutes. Given the un-usable repro steps, I decided to pull down tip blender source (as of yesterday) to get a full callstack. Hopefully the detailed callstack will prove more helpful than the repro steps.
As mentioned in the title, all the crashes I've seen occur in ccgdm_getVertCos, either in the last loop or second-to-last loop in the file. The crashes all seem to be related to vertMap2 containing invalid data; I thought I could get away with adding nullguards for the return value of ccgSubSurf_getEdgeData and the contents of vertMap2[index], but most recently I've gotten a crash due to vertMap2 containing a non-null invalid pointer. Here is some more details for the application state on that referenced crash (which occurred in the final loop in the referenced function):
totvert = 146
index = 2
vertMap2[index] = 0x0000000500000004 {next=??? vHDL=??? numEdges=??? ...}
and the first few entries in vertMap2:
- vertMap2,146 0x000000001eb9aa58 {0x000000001cea91e0 {next=0x000000001ceaad48 {next=0x0000000000000000 <NULL> vHDL=...} ...}, ...} CCGVert *[146]
+ [0] 0x000000001cea91e0 {next=0x000000001ceaad48 {next=0x0000000000000000 <NULL> vHDL=0x0000000000000043 ...} ...} CCGVert *
+ [1] 0x000000001cea9240 {next=0x000000001ceaada8 {next=0x0000000000000000 <NULL> vHDL=0x0000000000000044 ...} ...} CCGVert *
+ [2] 0x0000000500000004 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [3] 0x0000000700000006 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [4] 0x0000000900000008 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [5] 0x0000000b0000000a {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [6] 0x0000000d0000000c {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [7] 0x0000000f0000000e {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [8] 0x0000001100000010 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [9] 0x0000001300000012 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [10] 0x0000001500000014 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
+ [11] 0x0000001700000016 {next=??? vHDL=??? numEdges=??? ...} CCGVert *
I can't really make heads or tails of this code but in general casting an arbitrary pointer to an int seems like a very bad idea, which the comments next to the GET_INT_FROM_POINTER macro seem to agree with