[Linux] Assertion fail on LLMeshSkinInfo::updateHash

[tapple]

Environment

Self-built viewer on this branch: #5739. Built with GCC

Second Life Test 26.1.1.261202149 (64bit)
Release Notes
Build Configuration RelWithDebInfo

You are at 159.7, 137.7, 22.7 in Rumpus Room 2048 located at simhost-0e6f7080d26c4f0b0.aditi
SLURL: secondlife://Aditi/secondlife/Rumpus%20Room%202048/160/138/23
(global coordinates 36511.7, 14217.7, 22.7)
Second Life Server 2026-01-28.21455867889
Release Notes

CPU: AMD Ryzen 7 7840HS w/ Radeon 780M Graphics (3801 MHz)
Memory: 27852 MB
OS Version: Linux 6.19.14-200.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Apr 23 17:34:07 UTC 2026 x86_64
Graphics Card Vendor: AMD
Graphics Card: AMD Radeon 780M Graphics (radeonsi, phoenix, LLVM 21.1.8, DRM 3.64, 6.19.14-200.fc43.x86_64)

OpenGL Version: 4.6 (Compatibility Profile) Mesa 25.3.6

Window size: 2048x1208
Font Size Adjustment: 96pt
UI Scaling: 1
Draw distance: 96m
Bandwidth: 3000kbit/s
LOD factor: 1.125
Render quality: 1
Texture memory: 4096MB
Disk cache: Max size 2150.4 MB (100.0% used)

J2C Decoder Version: OpenJPEG runtime: 2.5.4
Audio Driver Version: OpenAL, version 1.1 ALSOFT 1.24.2 / OpenAL Community / OpenAL Soft: OpenAL Soft
Dullahan: 1.26.0.202510161627
CEF: 139.0.40+g465474a+chromium-139.0.7258.139
Chromium: 139.0.7258.139
LibVLC Version: 3.0.23
Voice Server Version: Not Connected
Packets Lost: 11/2164 (0.5%)
April 30 2026 16:49:42

Description

It happened when I closed a lsl script window.

Self-built viewer on this branch: #5739. Built with GCC

gdb backtrace:

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007faa5ea81493 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007faa5ea2715e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007faa5ea0e6d0 in __GI_abort () at abort.c:77
#4  0x00007faa5ec0b084 in std::__glibcxx_assert_fail (file=<optimized out>, line=<optimized out>, function=<optimized out>, condition=<optimized out>) at ../../../../../libstdc++-v3/src/c++11/assert_fail.cc:41
#5  0x0000000000801ef0 in std::vector<LLMatrix4a, std::allocator<LLMatrix4a> >::operator[] (this=0x7fa9ec0b2180, __n=0) at /usr/include/c++/15/bits/stl_vector.h:1263
#6  0x00000000044f7f14 in LLMeshSkinInfo::updateHash (this=0x7fa9ec0b2130) at /home/tapple/cabbage/secondlife/viewer/indra/llprimitive/llmodel.cpp:1805
#7  0x00000000044f58ef in LLMeshSkinInfo::fromLLSD (this=0x7fa9ec0b2130, skin=...) at /home/tapple/cabbage/secondlife/viewer/indra/llprimitive/llmodel.cpp:1718
#8  0x00000000044f4787 in LLMeshSkinInfo::LLMeshSkinInfo (this=0x7fa9ec0b2130, mesh_id=..., skin=...) at /home/tapple/cabbage/secondlife/viewer/indra/llprimitive/llmodel.cpp:1628
#9  0x00000000021e6c5f in LLMeshRepoThread::skinInfoReceived (this=0x14332d10, mesh_id=..., data=0x7fa9f013d350 "xګf```\314\006\022\202I\231y)\361\305\031\211\005\251\361\271\211%E\231\025\321@Q\201\"\006(\030$\214\330Z", data_size=45)
    at /home/tapple/cabbage/secondlife/viewer/indra/newview/llmeshrepository.cpp:2462
#10 0x000000000220db1d in LLMeshSkinInfoHandler::processSkin (this=0x7fa9f014d5a0, data=0x7fa9f013d350 "xګf```\314\006\022\202I\231y)\361\305\031\211\005\251\361\271\211%E\231\025\321@Q\201\"\006(\030$\214\330Z", data_size=45)
    at /home/tapple/cabbage/secondlife/viewer/indra/newview/llmeshrepository.cpp:3925
#11 0x000000000220ec18 in operator() (__closure=0x7fa9ec0b24c0) at /home/tapple/cabbage/secondlife/viewer/indra/newview/llmeshrepository.cpp:3994
#12 0x0000000002245046 in std::__invoke_impl<void, LLMeshSkinInfoHandler::processData(LLCore::BufferArray*, S32, U8*, S32)::<lambda()>&>(std::__invoke_other, struct {...} &) (__f=...) at /usr/include/c++/15/bits/invoke.h:63
#13 0x0000000002244bf4 in std::__invoke_r<void, LLMeshSkinInfoHandler::processData(LLCore::BufferArray*, S32, U8*, S32)::<lambda()>&>(struct {...} &) (__fn=...) at /usr/include/c++/15/bits/invoke.h:113
#14 0x000000000224449d in std::_Function_handler<void(), LLMeshSkinInfoHandler::processData(LLCore::BufferArray*, S32, U8*, S32)::<lambda()> >::_M_invoke(const std::_Any_data &) (__functor=...) at /usr/include/c++/15/bits/std_function.h:292
#15 0x0000000000935ac0 in std::function<void()>::operator() (this=0x7faa137f3310) at /usr/include/c++/15/bits/std_function.h:593
#16 0x00000000054458df in LL::WorkQueueBase::callWork (this=0x1422b180, work=...) at /home/tapple/cabbage/secondlife/viewer/indra/llcommon/workqueue.cpp:217
#17 0x00000000054423e7 in LL::WorkQueueBase::runUntilClose (this=0x1422b180) at /home/tapple/cabbage/secondlife/viewer/indra/llcommon/workqueue.cpp:87
#18 0x000000000543b566 in LL::ThreadPoolBase::run (this=0x13f67550) at /home/tapple/cabbage/secondlife/viewer/indra/llcommon/threadpool.cpp:152
#19 0x000000000543a3ca in LL::ThreadPoolBase::run (this=0x13f67550, name="ThreadPool:MeshLodProcessing:2/2") at /home/tapple/cabbage/secondlife/viewer/indra/llcommon/threadpool.cpp:146
#20 0x0000000005435dae in operator() (__closure=0x14334f68) at /home/tapple/cabbage/secondlife/viewer/indra/llcommon/threadpool.cpp:83
#21 0x000000000543efb8 in std::__invoke_impl<void, LL::ThreadPoolBase::start()::<lambda()> >(std::__invoke_other, struct {...} &&) (__f=...) at /usr/include/c++/15/bits/invoke.h:63
#22 0x000000000543ef7b in std::__invoke<LL::ThreadPoolBase::start()::<lambda()> >(struct {...} &&) (__fn=...) at /usr/include/c++/15/bits/invoke.h:98
#23 0x000000000543ef36 in std::thread::_Invoker<std::tuple<LL::ThreadPoolBase::start()::<lambda()> > >::_M_invoke<0>(std::_Index_tuple<0>) (this=0x14334f68) at /usr/include/c++/15/bits/std_thread.h:303
#24 0x000000000543ef0a in std::thread::_Invoker<std::tuple<LL::ThreadPoolBase::start()::<lambda()> > >::operator()(void) (this=0x14334f68) at /usr/include/c++/15/bits/std_thread.h:310
#25 0x000000000543eeee in std::thread::_State_impl<std::thread::_Invoker<std::tuple<LL::ThreadPoolBase::start()::<lambda()> > > >::_M_run(void) (this=0x14334f60) at /usr/include/c++/15/bits/std_thread.h:255
#26 0x00007faa5ec4e424 in std::execute_native_thread_routine (__p=0x14334f60) at ../../../../../libstdc++-v3/src/c++11/thread.cc:104
#27 0x00007faa5ea7f464 in start_thread (arg=<optimized out>) at pthread_create.c:448
#28 0x00007faa5eb025ec in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Last few log lines:

2026-04-30T23:37:35Z INFO # llui/llfloater.cpp(709) closeFloater : Closing floater script ed float
2026-04-30T23:37:35Z INFO #ScriptEditorWS# newview/llscripteditorws.cpp(850) sendDisconnect : Sending disconnect to client: Editor closed
[2026-04-30 16:37:35] [frame_header] Dispatching write containing 1 message(s) containing 2 header bytes and 105 payload bytes
[2026-04-30 16:37:35] [frame_header] Header Bytes: 
[0] (2) 81 69 

[2026-04-30 16:37:35] [frame_payload] Payload Bytes: 
[0] (105) [1] {"jsonrpc":"2.0","method":"script.unsubscribe","params":{"script_id":"bfbdf154092641f6a636d0a0f6617a68"}}

2026-04-30T23:37:35Z INFO #WebSocket# llcorehttp/llwebsocketmgr.cpp(652) LLWebsocketMgr::closeConnection : WSConnection closing connection with code 1000 and reason: Editor closed
2026-04-30T23:37:35Z INFO #WebSocket# llcorehttp/llwebsocketmgr.cpp(501) LLWebsocketMgr::closeConnection : script_editor_server initiated close for connection with code 1000 and reason: Editor closed
[2026-04-30 16:37:35] [frame_header] Dispatching write containing 2 message(s) containing 4 header bytes and 110 payload bytes
[2026-04-30 16:37:35] [frame_header] Header Bytes: 
[0] (2) 81 5F 
[1] (2) 88 0F 

[2026-04-30 16:37:35] [frame_payload] Payload Bytes: 
[0] (95) [1] {"jsonrpc":"2.0","method":"session.disconnect","params":{"message":"Editor closed","reason":1}}
[1] (15) [8] 03 E8 45 64 69 74 6F 72 20 63 6C 6F 73 65 64 

[2026-04-30 16:37:35] [error] handle_read_frame error: websocketpp.transport:7 (End of File)
2026-04-30T23:37:35Z INFO #JSONRPC# llcorehttp/lljsonrpcws.cpp(47) onClose : JSON-RPC connection closed, clearing 0 pending requests
2026-04-30T23:37:35Z INFO #JSONRPC# llcorehttp/lljsonrpcws.cpp(503) onConnectionClosed : JSON-RPC client disconnected, total connections: 0
2026-04-30T23:37:35Z INFO #ScriptEditorWS# newview/llscripteditorws.cpp(114) onConnectionClosed : Script editor client disconnected
2026-04-30T23:37:35Z INFO #WebSocket# llcorehttp/llwebsocketmgr.cpp(601) LLWebsocketMgr::handleCloseConnection : script_editor_server closed connection, total connections: 0
[2026-04-30 16:37:35] [disconnect] Disconnect close local:[1006,End of File] remote:[1006]
2026-04-30T23:37:36Z INFO # newview/llviewerdisplay.cpp(246) display_stats : FPS: 28.90 SESSION JITTER: 0.4483 PERIOD JITTER: 0.0439
2026-04-30T23:37:41Z INFO #Inventory# newview/llinventorymodelbackgroundfetch.cpp(524) setAllFoldersFetched : Inventory background fetch completed
2026-04-30T23:37:41Z WARNING # newview/llfloatertools.cpp(502) refresh : Failed to get selected object
/usr/include/c++/15/bits/stl_vector.h:1263: constexpr std::vector<_Tp, _Alloc>::reference std::vector<_Tp, _Alloc>::operator[](size_type) [with _Tp = LLMatrix4a; _Alloc = std::allocator<LLMatrix4a>; reference = LLMatrix4a&; size_type = long unsigned int]: Assertion '__n < this->size()' failed.
[34843:34951:0430/164012.674401:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[34845:34966:0430/164026.859077:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[34844:34985:0430/164029.824275:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
[34846:34950:0430/164032.718177:ERROR:google_apis/gcm/engine/registration_request.cc:291] Registration response error message: DEPRECATED_ENDPOINT
2026-04-30T23:45:36Z INFO # llcommon/llapp.cpp(596) default_unix_signal_handler : Signal handler - Got signal 6 - Abort
2026-04-30T23:45:36Z WARNING # llcommon/llapp.cpp(615) default_unix_signal_handler : Signal handler - Got SIGABRT, terminating

2026-04-30T23:46:59Z WARNING #APR# llcommon/llapr.cpp(236) _ll_apr_warn_status : APR: /home/tapple/cabbage/secondlife/viewer/indra/llplugin/llpluginmessagepipe.cpp:345 Connection reset by peer
2026-04-30T23:46:59Z INFO #Plugin# llplugin/llpluginprocesschild.cpp(95) LLPluginProcessChild::idle : message pipe is in error state (104), moving to STATE_ERROR
2026-04-30T23:46:59Z WARNING #APR# llcommon/llapr.cpp(236) _ll_apr_warn_status : APR: /home/tapple/cabbage/secondlife/viewer/indra/llplugin/llpluginmessagepipe.cpp:345 Connection reset by peer
2026-04-30T23:46:59Z INFO #Plugin# llplugin/llpluginprocesschild.cpp(95) LLPluginProcessChild::idle : message pipe is in error state (104), moving to STATE_ERROR
2026-04-30T23:46:59Z WARNING #APR# llcommon/llapr.cpp(236) _ll_apr_warn_status : APR: /home/tapple/cabbage/secondlife/viewer/indra/llplugin/llpluginmessagepipe.cpp:345 Connection reset by peer
2026-04-30T23:46:59Z INFO #Plugin# llplugin/llpluginprocesschild.cpp(95) LLPluginProcessChild::idle : message pipe is in error state (104), moving to STATE_ERROR
2026-04-30T23:46:59Z WARNING #APR# llcommon/llapr.cpp(236) _ll_apr_warn_status : APR: /home/tapple/cabbage/secondlife/viewer/indra/llplugin/llpluginmessagepipe.cpp:345 Connection reset by peer
2026-04-30T23:46:59Z INFO #Plugin# llplugin/llpluginprocesschild.cpp(95) LLPluginProcessChild::idle : message pipe is in error state (104), moving to STATE_ERROR
./build-linux-x86_64/newview/packaged/secondlife: line 59: 34480 Aborted                    (core dumped) $LL_WRAPPER bin/do-not-directly-run-secondlife-bin "${ARGS[@]}"
*** Bad shutdown ($LL_RUN_ERR). ***
tapple@fedora:~/cabbage/secondlife/viewer$ 
tapple@fedora:~/cabbage/secondlife/viewer$ 2026-04-30T23:47:00Z WARNING #Plugin# llplugin/llpluginmessagepipe.cpp(78) LLPluginMessagePipeOwner::writeMessageRaw : dropping message: <llsd>
    <map>
    <key>class</key>
        <string>base</string>
    <key>name</key>
        <string>goodbye</string>
    <key>params</key>
        <map />
    </map>
</llsd>

2026-04-30T23:47:00Z WARNING #Plugin# llplugin/llpluginmessagepipe.cpp(78) LLPluginMessagePipeOwner::writeMessageRaw : dropping message: <llsd>
    <map>
    <key>class</key>
        <string>base</string>
    <key>name</key>
        <string>goodbye</string>
    <key>params</key>
        <map />
    </map>
</llsd>

Reproduction steps

On fedora linux, checkout the lua_editor branch and, build like

autobuild configure -c $RelWithDebInfoOS -- -DCLANG_DISABLE_FATAL_WARNINGS=TRUE
autobuild build -c $RelWithDebInfoOS --no-configure

1. Teleport to rumpus room on beta grid
2. look around

It seems to happen pretty quickly just from logging in to rumpus room on beta grid on this viewer and looking around

---

This repo is using Opire - what does it mean? 👇

💵 Everyone can add rewards for this issue commenting /reward 100 (replace 100 with the amount).
🕵️‍♂️ If someone starts working on this issue to earn the rewards, they can comment /try to let everyone know!
🙌 And when they open the PR, they can comment /claim #5748 either in the PR description or in a PR's comment.

🪙 Also, everyone can tip any user commenting /tip 20 @tapple (replace 20 with the amount, and @tapple with the user to tip).

📖 If you want to learn more, check out our documentation.