cmds.controller segfault crashes Maya 2025 on dagmenu right-click

[BramVR]

Description

Right-clicking on body/spine controls in the viewport hard-crashes Maya 2025 with a segfault. No Python traceback, no error message. Maya closes to desktop immediately.

Root Cause

get_all_tag_children() in pickWalk.py calls cmds.controller(tags, query=True, children=True) to traverse the controller tag hierarchy. This command has a C++ bug in Maya 2025 that causes a segfault on certain controller tag nodes. Since this is a C++ crash, try/except cannot catch it.

The crash happens during mgear_dagmenu_fill when building the right-click menu for controls that have controller tag children (e.g. body or spine controls that parent arm/hand/finger hierarchies).

Why It Affects Some Controls and Not Others

The crash is triggered by specific controller tag nodes that cmds.controller cannot handle. Controls higher in the hierarchy (body, spine) are more likely to crash because get_all_tag_children traverses all descendants. A spine control walks through neck, shoulders, arms, hands, fingers, and any additional child controls, making it more likely to encounter a problematic tag node. Controls lower in the hierarchy (arms, fingers) may work fine because their traversal covers a smaller subset that never reaches those tags.

In our case, the traversal from a spine control expanded across 6 iterations (5, 5, 15, 54, 61, 71 tags) before hitting the crash. Even splitting the batch call into individual per-tag queries still crashed, confirming the issue is with cmds.controller itself on specific tag nodes, not with the number of tags passed.

Steps to Reproduce

1. Open a rig with controller tags (mGear-built rig with body/spine/arm hierarchy)
2. Select a body or spine control
3. Right-click in viewport
4. Maya crashes (segfault, no error message)

Proposed Fix

Replace cmds.controller with direct cmds.listConnections traversal of the controller tag .children and .controllerObject attributes. This achieves the same result without using the buggy cmds.controller command. Also adds cycle protection via a seen_tags set.

Environment

• Maya 2025 (build 202409190603)
• mGear 5.2.1
• Windows 11

[miquelcampos]

Hi @BramVR Thanks for the PR! I will check it all today 😄

[miquelcampos]

Hi @BramVR thanks again for the feedback and PR. I am checking this but I can't reproduce the error. I am in Maya 2025.3.2 on windows 11. when you indicate the build looks like is 2024 not 2025 can you confirm this?

[BramVR]

Hi Miguel, thanks for checking!

Yes, it is Maya 2025.3. The 202409190603 is the build compilation date (September 2024), not the Maya version.

The crash for us happened specifically on controls high in the controller tag hierarchy (body, spine) where the traversal expands to 50-70+ descendant tags. Controls lower in the hierarchy (arms, fingers) worked fine. If you want to try reproducing, a rig with a deep/wide controller tag hierarchy would be the one to test with.

[BramVR]

crash_repro_files.zip

Hi Miguel,

I managed to create a minimal reproduction case. The crash requires two conditions:

1. A controller tag hierarchy with the topology of a production rig (many orphan root tags, wide fan-out nodes)
2. Calling cmds.controller(q=True, children=True) on every tag in the scene (which is what the dagmenu pickWalk code does)

Reproduction steps:

1. Download the two attached files: crash_repro_anon.ma (827 controller tags) and test_crash_repro.py
2. Open Maya 2025
3. Run in the Script Editor:

exec(open("path/to/test_crash_repro.py").read())

4. Maya crashes with a segfault

Crash log (from Maya's crash report):

Exception code: C0000005: ACCESS_VIOLATION - illegal read at address 0x0000000D
Fault address: in Foundation.dll

Call stack:
  Foundation.dll    TnameObject::isReserved()
  Foundation.dll    TnameObject::name()
  AnimSlice.dll     TtimeWarpCmd::undoIt()
  CommandEngine.dll TmetaCommand::doCommand()
  CommandEngine.dll TpythonInterpreter::dispatchMayaCommand()

Tags created in-memory and traversed immediately do not crash. The .ma file round-trip is required to trigger it.

Our environment: Maya 2025.3, Windows 11

It is possible this was fixed in 2025.3.2. If the repro file does not crash on your build, that would confirm the fix.