-
Notifications
You must be signed in to change notification settings - Fork 2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ACCESS VIOLATION with some games at suprnova.cpp #8506
Comments
Which video mode are you using? for example d3d, bgfx. |
Over here I use |
Using -bench 90, I was unable to get any crashes. |
Looks like it's fixed, tested with e135ac3. |
Sorry, after compiling the latest commit, crash still happens.
|
Testing with this binary it also keep crashing, however looks like it doesn't have any symbol. Test were done with the binary inside an empty folder.
The exact same happens to |
You need the sym file to get symbols. And I'm still unable to replicate your issue. |
The symbol file did not came with the 'action' build, maybe the admin need to adjust the build so we can have a symbol file for that specific build. The crash still happens at random. |
The issue also happens on linux, I don't know how to debug, however, following this instructions I was able to compile just the suprnova.cpp driver with addresssanitizer. This is what it show up:
Last commit on Command used to compile mame: I hope this helps, the AddressSanitizer also points others erros that I don't understand, maybe a developer can look into it and see what is relevant (or not) to investigate. Thanks. |
OK, that trace explains it. The SKNS sprite device is doing an out-of-bounds access when drawing zoomed sprites – it’s crashing in the if(zoomx_m || zoomx_s || zoomy_m || zoomy_s)
{
blit_z[ (xflip<<1) | yflip ](bitmap, cliprect, m_decodebuffer.get(), sx, sy, xsize, ysize, zoomx_m, zoomx_s, zoomy_m, zoomy_s, NewColour);
} I’d guess what’s happening is it isn’t checking the row against the clipping rectangle when drawing zoomed and writing past the end of the bitmap. However, the code is so obfuscated by the macros I can’t really follow the logic. Thanks for running it under a memory analyser – that’s the very best thing you can do for this kind of crash. |
Thank you @cuavas |
Ok, the drawing is going oob in the (source) sprite decompression buffer (m_decodebuffer) when transitioning from the "bios" intro to the game one. It's reading before the start afaict. Need to find out what combination of probably transitory values allows it to happen. |
It should be fixed with my latest push, let me know. |
Test run for about 4 hours with the latest commit, no crashes. Closing. |
This problem still happens. See https://mametesters.org/view.php?id=8401 |
mame:
|
Off-by-1 boundary check bugfix here: 43e74c6 I don't know if it fixes this issue, it's very hard to repro the crash here since it rarely happens for me. |
Over here still happens after 43e74c6
|
Are you sure? I thought max_x / max_y were inclusive?
…On 25/08/2022 20:38, hap wrote:
Off-by-1 boundary check bugfix here: 43e74c6
<43e74c6>
I don't know if it fixes this issue, it's very hard to repro the crash
here since it rarely happens for me.
—
Reply to this email directly, view it on GitHub
<#8506 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACGVYYTHE2OI4FPC4JNU4O3V27DSLANCNFSM5DALNYAQ>.
You are receiving this because you are subscribed to this
thread.Message ID: ***@***.***>
|
By the time you get to those macros, the numbers are exclusive. I’d have to search for the exact line where it happens, but when it calculates the destination coordinates taking sprite scaling into account, it produces exclusive right/bottom values. |
clip.max_x = (cliprect.max_x+1)<<16; note the +1 if yd or xd == max y or x then |
signed integer overflow fix: e4f8802 |
Fix e4f8802 confirmed. |
Well that obviously confused the person who wrote the code, is there any
advantage?
…On 26/08/2022 09:13, Vas Crabb wrote:
By the time you get to those macros, the numbers are exclusive. I’d
have to search for the exact line where it happens, but when it
calculates the destination coordinates taking sprite scaling into
account, it produces exclusive right/bottom values.
Message ID: ***@***.***>
|
It’s generally easier to work with exclusive right/bottom coordinates – size and scaling calculations are cleaner. Using inclusive coordinates for MAME’s rectangle structure was probably a mistake, but it’s too late to change that now. |
mame:
0.235 (mame0235-73-g0510428a31d)
, also tested with this binary.OS:
Windows 10 20H2 19042.1110
Issue:
galpans2
crashes soon after boot, after some further testing, looks like other games from the same driver crashes too.Crash happens with:
cyvern
,galpans2
,galpans2j
,galpans3
,panicstr
,ryouran
andteljan
.Generating a game list to run tests:
mame galpans2 -lb > list.txt | cat list.txt | awk '{print $2}' >to_test.txt
Result:
Command:
cmd /c for /F "tokens=*" %a in (to_test.txt) do mame -norc -rompath h:\roms -window -wdog 25 -bench 90 %a > log.txt 2>&1
log.txt
to_test.txt
The text was updated successfully, but these errors were encountered: