From d24e7f75efe91f307089afe4b48ec2c2e856104f Mon Sep 17 00:00:00 2001 From: raistlin7447 Date: Thu, 2 Jul 2026 11:08:15 -0500 Subject: [PATCH] fix: crash when rotating the prime tower (#14499) Selecting the prime tower and rotating it (PageUp/PageDown) crashed. Selection::notify_instance_update() indexed m_model->objects with the wipe tower's synthetic id (>= 1000), which is not a ModelObject index, so the lookup returned garbage and dereferencing it segfaulted. do_rotate/do_scale/do_mirror already skip the wipe tower in their own loops but all call this shared helper, so scale and mirror hit the same fault. Selection::drop() had the same latent bug via a direct index. Guard both with the >= 1000 check already used throughout the file. Fixes #14498 --- src/slic3r/GUI/Selection.cpp | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/slic3r/GUI/Selection.cpp b/src/slic3r/GUI/Selection.cpp index fadc5a3f2f..b2caaed55d 100644 --- a/src/slic3r/GUI/Selection.cpp +++ b/src/slic3r/GUI/Selection.cpp @@ -535,6 +535,9 @@ void Selection::drop() for (unsigned int i : m_list) { GLVolume& volume = *(*m_volumes)[i]; + // Skip the wipe tower: its synthetic id (>= 1000) is not an index into m_model->objects. + if (volume.object_idx() >= 1000) + continue; ModelObject* model_object = m_model->objects[volume.object_idx()]; if (model_object != nullptr) { @@ -1848,6 +1851,9 @@ void Selection::notify_instance_update(int object_idx, int instance_idx) for (unsigned int i : m_list) { int obj_index = (*m_volumes)[i]->object_idx(); + // Skip the wipe tower: its synthetic id (>= 1000) is not an index into m_model->objects. + if (obj_index >= 1000) + continue; //-1 means all the instance in this object if (instance_idx == -1) {