Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
02539 Crash/Freeze Critical (emulator) Always Oct 13, 2008, 08:28 Oct 16, 2008, 06:05
Tester Firewave View Status Public Platform MAME (Self-compiled)
Assigned To couriersud Resolution Fixed OS
Status [?] Resolved Driver merit/merit.cpp
Version 0.127u7 Fixed in Version 0.128 Build Debug
Fixed in Git Commit Github Pull Request #
Summary 02539: phrcraze, phrcrazes: [debug] Access Violation
Description -----------------------------------------------------
Exception at EIP=0062C23F (video_update_meadows+0x068e): ACCESS VIOLATION
While attempting to read memory at 11DB2000
-----------------------------------------------------
EAX=11DB2000 EBX=00000040 ECX=00000000 EDX=00001000
ESI=FFFFFFFF EDI=0062C184 EBP=0022FA78 ESP=0022FA00
Steps To Reproduce
Additional Information phrcrazs -> phrcrazes in 0.133u1
phrcrazes - > phrcrazev in 0.138
Github Commit
Flags Debug build specific
Regression Version 0.127u7
Affected Sets / Systems phrcraze, phrcrazes
Attached Files
 
Relationships
There are no relationship linked to this issue.
Notes
3
User avatar
No.02836
couriersud
Developer
Oct 14, 2008, 07:13
This is completely weird. video_update_meadows is not referred in the merit.c driver at all.
The bug does not reproduce on sdlmame (linux) as well.
Can you please provide a backtrace?
User avatar
No.02839
Firewave
Senior Tester
Oct 14, 2008, 08:23
The .map file gives to give wrong information about the actual function (usually does that). Here's a proper backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',
    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204
204 int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (ext
ra_video_bank_bit)) << 4) | (ra & 0x0f);
(gdb) bt full
#0 0x005f4624 in update_row (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904, ma=4096, ra=0 '\0', y=264, x_count=64 '@',
    cursor_x=-1 ' ', param=0x2333ce0) at src/mame/drivers/merit.c:204
        i = -1
        region = 0
        colour = 0
        data = (UINT8 *) 0x12a51ffc ""
        attr = 0
        addr = 7
        cx = 0 '\0'
        pens = (pen_t *) 0x2333ce0
        gfx = {0x12a51ffc "", 0x12a81ffc ""}
        x = 0
        rlen = 32768
#1 0x009f7545 in mc6845_update (device=0xb831fbc, bitmap=0x14791fe0,
    cliprect=0x22f904) at src/emu/video/mc6845.c:659
        ra = 0 '\0'
        cursor_visible = 0
        cursor_x = -1 ' '
        y = 264
        param = (void *) 0x2333ce0
        mc6845 = (mc6845_t *) 0x13fa1fa0
#2 0x005f496b in video_update_merit (screen=0xb821f74, bitmap=0x14791fe0,
    cliprect=0x22f904) at src/mame/drivers/merit.c:845
        mc6845 = (const device_config *) 0xb831fbc
#3 0x00997685 in video_screen_update_partial (screen=0xb821f74, scanline=267)
    at src/emu/video.c:848
        flags = 1
        state = (screen_state *) 0x13f91f20
        clip = {min_x = 0, max_x = 511, min_y = 12, max_y = 267}
        result = 0
#4 0x0099927d in finish_screen_updates (machine=0xb781f34)
    at src/emu/video.c:1556
        screen = (const device_config *) 0xb821f74
        anything_changed = 0
#5 0x00998fbc in video_frame_update (machine=0xb781f34, debug=0)
    at src/emu/video.c:1488
        anything_changed = 2292408
        current_time = {seconds = 0, attoseconds = 115062400000000000}
        skipped_it = 0
        phase = 3
#6 0x00998c40 in vblank_begin_callback (machine=0xb781f34, ptr=0xb821f74,
    param=0) at src/emu/video.c:1380
        i = 1
        screen = (device_config *) 0xb821f74
        state = (screen_state *) 0x13f91f20
#7 0x009bc22f in timer_set_global_time (machine=0xb781f34, newbase=
      {seconds = 0, attoseconds = 115062400000000000}) at src/emu/timer.c:359
        was_enabled = 1
        timer = (emu_timer *) 0x2b22560
#8 0x009c4f5a in cpuexec_timeslice (machine=0xb781f34)
    at src/emu/cpuexec.c:335
        target = {seconds = 0, attoseconds = 115062400000000000}
        base = {seconds = 0, attoseconds = 114320800000000000}
        cpunum = 1
        ran = 1860
#9 0x0098317b in mame_execute (options=0x8a91e58) at src/emu/mame.c:345
        settingsloaded = 0
        driver = (const game_driver *) 0x17feb50
        machine = (running_machine *) 0xb781f34
        mame = (mame_private *) 0xb791f68
        cb = (callback_item *) 0x8a91e58
        gamename = (astring *) 0xb781f00
        exit_pending = 0
        error = 0
        firstgame = 0
        firstrun = 0
#10 0x00ba2e4c in cli_execute (argc=6, argv=0x89f1fe8, osd_options=0x21149b0)
    at src/emu/clifront.c:171
        options = (core_options *) 0x8a91e58
        gamename = (astring *) 0x8a71f00
        exename = (astring *) 0x8a81f00
        gamename_option = 0x8ac1f08 "phrcraze"
        driver = (const game_driver *) 0x17feb50
        result = -1
#11 0x00928fa8 in utf8_main (argc=6, argv=0x89f1fe8)
    at src/osd/windows/winmain.c:257
        ext = 0x286c498 ".map"
#12 0x011fd2e9 in main (argc=6, a_argv=0x6e92758) at src/osd/windows/main.c:72
        i = 6
        rc = 2293624
        utf8_argv = (char **) 0x89f1fe8
        argv = (TCHAR **) 0x6e92838
        wenviron = (WCHAR **) 0x6e95080
User avatar
No.02855
couriersud
Developer
Oct 16, 2008, 00:45
The code where it happens is

int addr = ((ram_video[ma] | ((attr & 0x80) << 1) | (extra_video_bank_bit)) << 4) | (ra & 0x0f);

ma = 4096 on scanline 264. ram_video only has a size of 4096. 264 also looks like being in the vblank area. However clip indicates visible area till 267.
Weird. Putting in (ma &07ff) properly reflects the schematics. Only lines MA0 to MA10 are hooked up.