Geoprocessing tools cause libgeos to throw SIGBUS

[3R1N]

What is the bug or the crash?

Vector geoprocessing tools, such as Union and Intersection, can't cope with certain geometries, resulting in a SIGBUS exception getting thrown by the thread running libgeos.3.9.1.dylib. It seems to occur with extremely detailed geometries that overlap in complicated ways: as you can see from the attached crash report, it looks like the libgeos queryNode() function recurses and recurses until it runs out of stack space. Also, I've been able to work around it by either cutting the geometries into small pieces and dealing with them piecemeal, or by running Simplify and then doing the geoprocessing on the resulting layer.

I've enclosed a zip file containing a sample shapefile that produces this crash; I have verified that the crash occurs even in an otherwise empty project with a new profile.

Archive.zip
QGIS_2021-09-23_1735.txt

Steps to reproduce the issue

1. Create an empty project
2. Load "nps-wtf.shp" from attached zip file
3. Run Vector->Geoprocessing Tools-> Union
4. QGIS should crash before the process completes.

Versions

QGIS version	3.16.11-Hannover	QGIS code revision	26cc1c7
Compiled against Qt	5.14.2	Running against Qt	5.14.2
Compiled against GDAL/OGR	3.2.1	Running against GDAL/OGR	3.2.1
Compiled against GEOS	3.9.1-CAPI-1.14.2	Running against GEOS	3.9.1-CAPI-1.14.2
Compiled against SQLite	3.31.1	Running against SQLite	3.31.1
PostgreSQL Client Version	12.3	SpatiaLite Version	4.3.0a
QWT Version	6.1.4	QScintilla2 Version	2.11.4
Compiled against PROJ	6.3.2	Running against PROJ	Rel. 6.3.2, May 1st, 2020
OS Version	macOS High Sierra (10.13)
Active python plugins	nominatim; QuickOSM; db_manager; MetaSearch; processing

Supported QGIS version

• I'm running a supported QGIS version according to the roadmap.

New profile

• I tried with a new QGIS profile

Additional context

Some relevant sections from crash report (full crash report attached):

Process:               QGIS [6264]
Path:                  /Applications/QGIS-LTR.app/Contents/MacOS/QGIS
Identifier:            QGIS
Version:               3.16.11 (3.16.11 [])
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           QGIS [6264]
User ID:               501

Date/Time:             2021-09-23 17:27:47.228 -0400
OS Version:            Mac OS X 10.13.6 (17G14042)
Report Version:        12
Anonymous UUID:        8D9C73F3-3AA5-D91F-19DE-1342931D098B


Time Awake Since Boot: 180000 seconds

System Integrity Protection: enabled

Crashed Thread:        8  Thread (pooled)

Exception Type:        EXC_BAD_ACCESS (SIGBUS)
Exception Codes:       KERN_PROTECTION_FAILURE at 0x0000700003e3aff8
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Bus error: 10
Termination Reason:    Namespace SIGNAL, Code 0xa
Terminating Process:   exc handler [0]

VM Regions Near 0x700003e3aff8:
    Stack                  0000700003db8000-0000700003e3a000 [  520K] rw-/rwx SM=COW  thread 3
--> STACK GUARD            0000700003e3a000-0000700003e3b000 [    4K] ---/rwx SM=NUL  stack guard for thread 8
    Stack                  0000700003e3b000-0000700003ebd000 [  520K] rw-/rwx SM=COW  thread 8

---

Thread 8 Crashed:: Thread (pooled)
0   libgeos.3.9.1.dylib           	0x00000001110104d4 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 4
1   libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144
2   libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144
3   libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144

...snip...

509 libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144
510 libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144
511 libgeos.3.9.1.dylib           	0x0000000111010560 geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&) + 144

[rouault]

I can confirm with latest GEOS master (commit libgeos/geos@6c4b36c) by lowering the default stack size to 1 MB (instead of the default 8 MB) to make it easier to see the issue ("ulimit -s 1024" before starting QGIS). But at 2 MB, this is fine.

The stack trace looks like

Thread 32 "Thread (pooled)" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fff450f6700 (LWP 1750887)]
0x00007fffe50142db in geos::index::kdtree::KdTree::queryNode (this=0x7fff18da63d0, Python Exception <class 'RecursionError'> maximum recursion depth exceeded while getting the str of an object: 
currentNode=0x7fff1827f7c0, queryEnv=..., odd=false, visitor=...) at /home/even/geos/src/index/kdtree/KdTree.cpp:168
168	        max = queryEnv.getMaxY();
(gdb) bt
#0  0x00007fffe50142db in geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&)Python Exception <class 'RecursionError'> maximum recursion depth exceeded while getting the str of an object: 

    (this=0x7fff18da63d0, currentNode=0x7fff1827f7c0, queryEnv=..., odd=false, visitor=...) at /home/even/geos/src/index/kdtree/KdTree.cpp:168
#1  0x00007fffe501436e in geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&)Python Exception <class 'RecursionError'> maximum recursion depth exceeded while getting the str of an object: 

    (this=0x7fff18da63d0, currentNode=0x7fff1827f788, queryEnv=..., odd=<optimized out>, visitor=...) at /home/even/geos/include/geos/index/kdtree/KdNode.h:49
#2  0x00007fffe501436e in geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&)Python Exception <class 'RecursionError'> maximum recursion depth exceeded while getting the str of an object: 

    (this=0x7fff18da63d0, currentNode=0x7fff1827f750, queryEnv=..., odd=<optimized out>, visitor=...) at /home/even/geos/include/geos/index/kdtree/KdNode.h:49
#3  0x00007fffe501436e in geos::index::kdtree::KdTree::queryNode(geos::index::kdtree::KdNode*, geos::geom::Envelope const&, bool, geos::index::kdtree::KdNodeVisitor&)Python Exception <class 'RecursionError'> maximum recursion depth exceeded while getting the str of an object: 

[rouault]

Pull request submitted to GEOS per libgeos/geos#481