Build 12933 and 12947, crashing GTA5_b3258.exe!sub_1414C81F4

[FingerlessGlov3s]

What happened?

We moved from b11427 to b12947, to get ourselves more up to date and get the new Node22, but something is causing players within the same area to crash. The problem did move area a few times, but mostly around pillbox probably due to high population area, we do have custom MLO's for Pillbox and Casino. All that we know is something happens and crashes all players in scope or distance from whatever causes the crash, if it's a player causing it we assign the other players have to be within the scope of that player.

We then rolled back to b12933 but the issue still persisted, so we've now just reverted back to b11427 since we can't keep rolling back the build until it doesn't happen because that isn't ideal for the player base.

Multiple of us tried to replicate the issue on our local development instances of fxserver, using the same build and same resources etc, but no joy in being able to recreate the problem.

Crash errors are;
GTA5_b3258.exe!sub_1414C81F4 (0x14) - Seen 952 times
GTA5_b3258.exe!sub_1414C81F4 (0x39) - Seen 370 times

Crashing happened to 400+ users as logged by our logging system

Crash DMP files, hopefully these can aid to what the problem is.

GTA5_b3258.exe!sub_1414C81F4 (0x14) - 8c52c3e5-a966-4397-b283-1e03145292d1.dmp

GTA5_b3258.exe!sub_1414C81F4 (0x39) - 793342b0-f620-442c-9361-458a4c9293f9.dmp

Expected result

No crashing

Reproduction steps

Unable to reproduce sadly.

Importancy

Crash

Area(s)

FiveM

Specific version(s)

FiveM

Additional information

No response

[DaniGP17]

I hope this can help, function that crash: 48 8B C4 55 53 57 48 8D A8 ? ? ? ? 48 81 EC ? ? ? ? 0F 28 11.
First crash: It looks like is related to collision stuff, and the first param of the function is a nulltpr.
Second crash: Is in the same function but crash because the second param of the function is a nullptr.

[FingerlessGlov3s]

One thing I have just realised it moved the game build from b3095 to b3258, I thought sv_enforceGameBuild was in use, but sadly not. Wish I knew this at the time now.

So both crashes are collision related, is what you think it maybe pointing the problem too?

[DaniGP17]

So both crashes are collision related, is what you think it maybe pointing the problem too?

Yes, both crashes are collision related, but I don't know the exact cause of the problem.
I think it would be useful to get a full dump so we can see the entire call stack.

[FingerlessGlov3s]

So both crashes are collision related, is what you think it maybe pointing the problem too?

Yes, both crashes are collision related, but I don't know the exact cause of the problem. I think it would be useful to get a full dump so we can see the entire call stack.

How do I go about getting a full dumb? Do I need to do something with WinDbg?

[Gogsi]

You can configure FiveM to do full dumps - https://forum.cfx.re/t/enabling-and-uploading-full-client-dumps/1138940
Keep in mind they will be many GBs in size, but they compress really well in a zip, down to 1-2 GB. You'll have to then upload the zip to some cloud storage.

[FingerlessGlov3s]

We had a similar issue again last night, different crash code but I assume that's because of being on game build 3095 instead of the originally reported 3258

GTA5_b3095.exe!sub_1414B37A4

That was caused by someone being malicious and looked to be caused by prop prop_fragtest_cnst_04. Not sure if you need to spawn it in and then drive into it.

Unless someone else beats me to it, I'll see if I can make my client crash after work, to hopefully confirm the issue.

[DaniGP17]

GTA5_b3095.exe!sub_1414B37A4

Can you share crash dump of that crash?

That was caused by someone being malicious and looked to be caused by prop prop_fragtest_cnst_04. Not sure if you need to spawn it in and then drive into it.

Unless someone else beats me to it, I'll see if I can make my client crash after work, to hopefully confirm the issue.

Confirming that would be a great help. I can't test it for a few hours, so if someone can do it sooner that would be great.

[FingerlessGlov3s]

Can you share crash dump of that crash?
Sadly I wasn't there to get one, but shall try get one after work.

I have just googled on my phone and found the below, if you then follow the link within that comment, they've got a file called fragment crash, which looks to spawn the object then delete it a second later 🤔

YimMenu/YimMenu#2842 (comment)