FiveM client crash when SetPedHeadBlendData is followed by freemode mask component variation

[gtolontop]

What happened?

Calling SetPedHeadBlendData on a freemode ped, then applying a mask component variation, can crash the FiveM client.

I attached a minimal repro resource in the reproduction steps.

Crash seen on:

• GTA5_b3258.exe+6806E8
• Legacy crash hash: helium-mexico-muppet

Also previously seen on:

• GTA5_b3751.exe+684D26
• Legacy crash hash: idaho-bacon-paris

The repro uses a freemode ped (mp_m_freemode_01), applies neutral clothing/components, calls SetPedHeadBlendData, then applies mask component 1, drawable 28, texture 0.

Disabling the SetPedHeadBlendData path avoids the crash.

Expected result

SetPedHeadBlendData should either apply safely or fail gracefully. It should not crash the FiveM client process.

Reproduction steps

I attached a minimal repro resource: hb_headblend_crash_repro.zip.

The resource does not run the crash test automatically on start.

1. Add and start the attached resource:

ensure hb_headblend_crash_repro

2. Join the server with a FiveM client.

3. Run this command from F8:

hb_blend_mask male 28 0 visible

This command:

• switches the local player to mp_m_freemode_01
• prepares a neutral freemode ped
• keeps component 0 head visible
• calls SetPedHeadBlendData
• applies mask component 1, drawable 28, texture 0

Relevant native sequence:

SetPedHeadBlendData(
    ped,
    0, 0, 0,
    0, 0, 0,
    0.0, 0.0, 0.0,
    false
)

SetPedComponentVariation(ped, 1, 28, 0, 0)

4. The client crashes.

On my client this reliably crashes with:

GTA5_b3258.exe+6806E8
Legacy crash hash: helium-mexico-muppet

Importancy

Crash

Area(s)

Natives, ScRT: Lua, FiveM

Specific version(s)

• b3258: crashes with GTA5_b3258.exe+6806E8, legacy crash hash helium-mexico-muppet - b3751: also observed with GTA5_b3751.exe+684D26, legacy crash hash idaho-bacon-paris

Additional information

Related issue that may be connected:
#3648

In my resource, disabling head blend avoids the crash. Hiding the head for mask thumbnails is currently used as a workaround.

The attached repro resource writes the last received server-side trace to last_trace.json when it gets far enough before the crash.

[Gogsi]

Hey, I just want to make sure that you are not using the resource fivem-greenscreener. That resource streams a custom mp_f_freemode_01^head_000_r.ydd in order to achieve the empty head model and that causes issues with SetPedHeadBlendData , as reported on the forum

I've only seen it cause a mesh explosion but it is conceivable that it can also cause a crash.

[gtolontop]

Your actually right wow mybad im dumb sometime
Thanks bro