FeatherstoneArticulation::setupInternalConstraintsRecursive segfault when using an articulation with more than 255 links.

[mateobedel]

Hello,

I was wondering if someone already had a similar issue while initializing big articulations.

I have a recursive function that creates random articulation tree, and when the articulation gets too big (>=256 links) the physx function physx::Dy::FeatherstoneArticulation::setupInternalConstraintsRecursive in physx/source/lowleveldynamics/src/DyFeatherstoneArticulation.cpp segfault. (But it's working fine with 255 links).

I read the documentation and the articulation doesn't seem to have a link number limit (except a 64 one in older version), so it's a bit weird.

It's the 2551st line, which is the culprit :

if (j.motion[i] != PxArticulationMotion::eLOCKED) {
...
row[i] = data.mWorldMotionMatrix[jointDatum.jointOffset].top;  // <-------- here
}

Using GDB, jointDatum.jointOffset = 4294967295 = 0xFFFFFFFF and the function arguments looks really weird since linkCount = 9 and linkID = 26.

In my project, I think I don't even need the constraint solver since I'm only doing collision detection while moving manually the joints and I'm ignoring all resulting forces (gravity is set to 0 and the contact forces are disabled with a collision filter).
So if there is a way to disable this function call, it works for me as well.

I'm using the checked configuration with the 5.6.0.bcc9863a version.

Thanks.

[mateobedel]

Found the culprit :

Line 339 of DyFeatherstoneArticulation.cpp :

mArticulationData.mLinkCount = PxTo8(nbLinks);

nbLinks is casted to a 8bit uint in mLinkCount, so if it's greater than 255 it causes an integer overflow.

Leading to countDofs where the for loop iterates a wrong number of time :

for (PxU32 linkID = 1; linkID < linkCount; ++linkID) {
    const ArticulationLink& link = mArticulationData.getLink(linkID);
    ArticulationJointCoreData& jointDatum = mArticulationData.getJointData(linkID);
    const PxU8 dof = jointDatum.countJointDofs(link.inboundJoint);
    totalDofs += dof;
}

So countDofs returns the wrong value in FeatherstoneArticulation::setupDofs() and ArticulationData::resizeJointData is called with the wrong value :

PxU32 totalDofs = countDofs();
...
mArticulationData.resizeJointData(totalDofs + 1)

And finally, mWorldMotionMatrix is allocated with the wrong value :

void ArticulationData::resizeJointData(const PxU32 dofs) {
...
mWorldMotionMatrix.reserve(dofs);
...
}

Which lead to the read segfault in physx::Dy::FeatherstoneArticulation::setupInternalConstraintsRecursive :

row[i] = data.mWorldMotionMatrix[jointDatum.jointOffset].top;  

I didn't found this 255 links limit anywhere in the documentation or in the source code comments, it's weirdly hardcoded without any checking (even with the checked configuration), so it looks like a bug.

I'm keeping the discussion open in case someone have a way to create an articulation with more than 255 links, since this limit only seems to exist for the constraint solver that I don't need.

I'll try to use standard joints in the meantime which sadly don't support reduced coordinates.

[preist-nvidia]

Thank you for the detailed issue description and finding the culprit! I created a ticket for us to look at this, but cannot offer a timeline for fixing this, I'm glad you have a workaround for now.