From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 93551] Divinity: Original Sin Enhanced Edition(Native) crash on start Date: Thu, 31 Mar 2016 13:11:53 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1481476771==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id F3D806EA7D for ; Thu, 31 Mar 2016 13:11:53 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============1481476771== Content-Type: multipart/alternative; boundary="14594299134.E18E.7497"; charset="UTF-8" --14594299134.E18E.7497 Date: Thu, 31 Mar 2016 13:11:53 +0000 MIME-Version: 1.0 Content-Type: text/plain https://bugs.freedesktop.org/show_bug.cgi?id=93551 --- Comment #6 from smidjar2.reg@email.cz --- I disassembled ApplyConstants() where the game crashes when using OpenGL override to 4.2. It is indeed a game bug, caused by possible NULL dereference. Crash occurs at line marked by => 0x00007ffff48467e0 <+0>: push r15 0x00007ffff48467e2 <+2>: push r14 0x00007ffff48467e4 <+4>: push r12 0x00007ffff48467e6 <+6>: push rbx 0x00007ffff48467e7 <+7>: push rax 0x00007ffff48467e8 <+8>: mov r14,rdi 0x00007ffff48467eb <+11>: mov eax,DWORD PTR [r14+0x6f8] 0x00007ffff48467f2 <+18>: mov rcx,QWORD PTR [rip+0xd297] # 0x7ffff4853a90 0x00007ffff48467f9 <+25>: cmp eax,DWORD PTR [rcx] 0x00007ffff48467fb <+27>: je 0x7ffff4846959 <_ZN3api14OpenGLRenderer14ApplyConstantsEv+377> 0x00007ffff4846801 <+33>: xor r15d,r15d 0x00007ffff4846804 <+36>: test eax,0x3ff0000 0x00007ffff4846809 <+41>: je 0x7ffff4846845 <_ZN3api14OpenGLRenderer14ApplyConstantsEv+101> 0x00007ffff484680b <+43>: movzx ecx,ax 0x00007ffff484680e <+46>: mov edx,DWORD PTR [r14+0xc4] 0x00007ffff4846815 <+53>: xor r15d,r15d 0x00007ffff4846818 <+56>: cmp rcx,rdx 0x00007ffff484681b <+59>: jae 0x7ffff4846845 <_ZN3api14OpenGLRenderer14ApplyConstantsEv+101> 0x00007ffff484681d <+61>: shr eax,0x10 0x00007ffff4846820 <+64>: mov rdx,QWORD PTR [r14+0xe0] 0x00007ffff4846827 <+71>: xor r15d,r15d 0x00007ffff484682a <+74>: movzx edx,WORD PTR [rdx+rcx*2] 0x00007ffff484682e <+78>: and eax,0x3ff 0x00007ffff4846833 <+83>: cmp eax,edx 0x00007ffff4846835 <+85>: jne 0x7ffff4846845 <_ZN3api14OpenGLRenderer14ApplyConstantsEv+101> 0x00007ffff4846837 <+87>: imul r15,rcx,0x110 0x00007ffff484683e <+94>: add r15,QWORD PTR [r14+0xb8] => 0x00007ffff4846845 <+101>: mov rcx,QWORD PTR [r15+0x10] ...... //0x00007ffff48467eb: eax = this->variable_at_offset_0x6f8 //0x00007ffff48467f2: rcx = some_related_global_or_static_variable //0x00007ffff48467fb: if (eax != rcx) { // 0x00007ffff4846801: r15 = NULL if ((eax & 0x3ff0000) != 0) { // ... // r15 is set in this block to valid value // ... } // 0x00007ffff4846845: rcx = r15->variable_at_offset_0x10 // crash here because r15 can be NULL } // function end -- You are receiving this mail because: You are the assignee for the bug. --14594299134.E18E.7497 Date: Thu, 31 Mar 2016 13:11:53 +0000 MIME-Version: 1.0 Content-Type: text/html

Comment # 6 on bug 93551 from 
I disassembled ApplyConstants() where the game crashes when using OpenGL
override to 4.2. It is indeed a game bug, caused by possible NULL dereference.
Crash occurs at line marked by =>

   0x00007ffff48467e0 <+0>:    push   r15
   0x00007ffff48467e2 <+2>:    push   r14
   0x00007ffff48467e4 <+4>:    push   r12
   0x00007ffff48467e6 <+6>:    push   rbx
   0x00007ffff48467e7 <+7>:    push   rax
   0x00007ffff48467e8 <+8>:    mov    r14,rdi
   0x00007ffff48467eb <+11>:    mov    eax,DWORD PTR [r14+0x6f8]
   0x00007ffff48467f2 <+18>:    mov    rcx,QWORD PTR [rip+0xd297]        #
0x7ffff4853a90
   0x00007ffff48467f9 <+25>:    cmp    eax,DWORD PTR [rcx]
   0x00007ffff48467fb <+27>:    je     0x7ffff4846959
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+377>
   0x00007ffff4846801 <+33>:    xor    r15d,r15d
   0x00007ffff4846804 <+36>:    test   eax,0x3ff0000
   0x00007ffff4846809 <+41>:    je     0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff484680b <+43>:    movzx  ecx,ax
   0x00007ffff484680e <+46>:    mov    edx,DWORD PTR [r14+0xc4]
   0x00007ffff4846815 <+53>:    xor    r15d,r15d
   0x00007ffff4846818 <+56>:    cmp    rcx,rdx
   0x00007ffff484681b <+59>:    jae    0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff484681d <+61>:    shr    eax,0x10
   0x00007ffff4846820 <+64>:    mov    rdx,QWORD PTR [r14+0xe0]
   0x00007ffff4846827 <+71>:    xor    r15d,r15d
   0x00007ffff484682a <+74>:    movzx  edx,WORD PTR [rdx+rcx*2]
   0x00007ffff484682e <+78>:    and    eax,0x3ff
   0x00007ffff4846833 <+83>:    cmp    eax,edx
   0x00007ffff4846835 <+85>:    jne    0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff4846837 <+87>:    imul   r15,rcx,0x110
   0x00007ffff484683e <+94>:    add    r15,QWORD PTR [r14+0xb8]
=> 0x00007ffff4846845 <+101>:    mov    rcx,QWORD PTR [r15+0x10]
   ......


//0x00007ffff48467eb:
  eax = this->variable_at_offset_0x6f8
//0x00007ffff48467f2:
  rcx = some_related_global_or_static_variable
//0x00007ffff48467fb:
  if (eax != rcx) {
    // 0x00007ffff4846801:
    r15 = NULL
    if ((eax & 0x3ff0000) != 0) {
       // ...
       // r15 is set in this block to valid value
       // ...
    }
    // 0x00007ffff4846845:
    rcx = r15->variable_at_offset_0x10 // crash here because r15 can be NULL
  }
// function end

You are receiving this mail because:
  • You are the assignee for the bug.
--14594299134.E18E.7497-- --===============1481476771== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1481476771==--