03948: mvsc: Reset at staff roll only in the mvsc set.

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
03948	Crash/Freeze	Critical (emulation)	Always	Jul 19, 2010, 19:54	Jun 2, 2011, 17:16

Tester	SgtSarros	View Status	Public	Platform	MAME (Official Binary)
Assigned To	AWJ	Resolution	Fixed	OS	Windows XP (32-bit)
Status [?]	Resolved			Driver	capcom/cps2.cpp
Version	0.138	Fixed in Version	0.142u5	Build	Normal
		Fixed in Git Commit		Github Pull Request #

Summary	03948: mvsc: Reset at staff roll only in the mvsc set.
Description	As soon as the credits roll after beating the game, the words 'staff roll' bounces around the screen a bit and the game restarts itself.
Steps To Reproduce	Simply defeat onslaught and win the game.
Additional Information	Have does it on normal and easy difficulty. Have not beaten the game in one try yet so as unlikely as it is it's based on a bug from 'inserting coins' and continuing, I cannot verify that. Characters beaten the game with (on rare chance it was character-specific), morrigan / chun li (in both orders) as well as gambit / ryu (with gambit as winning)
Github Commit

Flags
Regression Version
Affected Sets / Systems	mvsc

Attached Files	0000.png (14,910 bytes) Jul 20, 2010, 01:03
	mvsc-inp-138u3.zip (453,398 bytes) Jul 20, 2010, 03:13
	mvsca-inp-138u3.zip (437,121 bytes) Jul 20, 2010, 15:03

No.06390 Fujix Administrator Jul 20, 2010, 00:49 edited on: Jul 20, 2010, 00:52	I did a quick test with a "drain all energy" cheat in available sets and it seems that only the mvsc set has the reset problem. Other sets including mcscr1 work correctly. Although it is weird that the newer version has the problem in original, probably we should reconfirm it with the original version. Until that, I add a Possible flag. And I can't complete the game without the cheat ;) Could any fighter reconfirm the issue?
No.06392 Smitdogg Senior Tester Jul 20, 2010, 03:13	It still happens. I uploaded an .inp file from .138u3.
No.06393 Haze Senior Tester Jul 20, 2010, 12:01	what about the alt regions of the same revision?
No.06394 Smitdogg Senior Tester Jul 20, 2010, 15:03	I uploaded one for mvsca. It didn't happen in this set.
No.06395 Haze Senior Tester Jul 20, 2010, 15:44	can you test the mvscud (phoenix bootleg) set in both it's native USA region, and set to EURO region (F2 on the CAPCOM phoenix edition screen) It might be a bug in the original game codepath for Euro, or a problem with that romset, because the phoenix set can run as both it's an interesting test case.
No.06397 AWJ Developer Jul 20, 2010, 16:08 edited on: Jul 20, 2010, 16:31	mvscu and mvscj don't reset during the staffroll either. And the phoenix set does not reset even when region set to Europe.
No.06398 Haze Senior Tester Jul 20, 2010, 17:10	I'd be suspicious of the roms for that set then.
No.06400 Smitdogg Senior Tester Jul 20, 2010, 19:35	It looks like Bonky dumped it so if anyone has a way to contact him you could ask for a redump.
No.06409 AWJ Developer Jul 22, 2010, 07:40	Yep, mvce.04a appears to be a bad dump... Disassemble at CPU address 80040 or 80060 and compare to any of the other region sets of the same revision.
No.06410 hap Developer Jul 22, 2010, 09:57	could you paste part of the disassembly here?
No.06413 AWJ Developer Jul 22, 2010, 15:03	mvscu, mvscj, mvsca: 080034: 4EF9 0000 1EFE jmp $1efe.l 08003A: 4EF9 0000 2490 jmp $2490.l 080040: 4EF9 0000 4542 jmp $4542.l 080046: 7000 moveq #$0, D0 080048: 102E 00B0 move.b ($b0,A6), D0 08004C: E248 lsr.w #1, D0 08004E: 1D7B 002C 0048 move.b ($2c,PC,D0.w), ($48,A6) 080054: 7000 moveq #$0, D0 080056: 102E 0048 move.b ($48,A6), D0 08005A: 0240 007F andi.w #$7f, D0 08005E: EB48 lsl.w #5, D0 080060: 227C 0091 4000 movea.l #$914000, A1 080066: D3C0 adda.l D0, A1 mvsc: 080034: 4EF9 0000 1EFE jmp $1efe.l 08003A: 4EF9 0000 2490 jmp $2490.l 080040: EB11 roxl.b #5, D1 080042: 0000 4542 ori.b #$42, D0 080046: 7000 moveq #$0, D0 080048: 102E 00B0 move.b ($b0,A6), D0 08004C: E248 lsr.w #1, D0 08004E: 1D7B 002C 0048 move.b ($2c,PC,D0.w), ($48,A6) 080054: 7000 moveq #$0, D0 080056: 102E 0048 move.b ($48,A6), D0 08005A: 0240 007F andi.w #$7f, D0 08005E: EB48 lsl.w #5, D0 080060: 0843 0091 bchg #$91, D3 080064: 4000 negx.b D0 080066: D3C0 adda.l D0, A1 You can see that the words at 80040 and 80060 (offsets 0x40 and 0x60 in mvce.04a) are wrong. It's likely that only a single bit at both addresses is actually flipped before the decryption.
No.06421 hap Developer Jul 23, 2010, 13:31	ok, it's now marked BAD_DUMP
No.06422 Lord Nightmare Developer Jul 23, 2010, 22:17	Could we patch the two obviously bad words, but keep the rom marked as bad dump until we get a proper redump? I think this makes sense if the bad bytes in the rom are pretty obvious...
No.06423 Smitdogg Senior Tester Jul 24, 2010, 00:10	The bad dump flag option is missing here when I went to edit the report?
No.06425 Tafoid Administrator Jul 24, 2010, 15:57	It was taken out. It was added for Guru by your request at the time to use. He never used it nor did he have much intention of using the site for anything like that. In short, it wasn't used by any Developer in over the year it was set up in the system and mistakenly used by a couple people reporting bugs, false accusing a rom of being bad when it was not. The best thing to do is simply leave a note or in the test somewhere in the report saying "bad dump". Use Mantis's search box when looking for possible other bad dumps, as these are changed in source usually soon after confirmation of such information.
No.06426 Smitdogg Senior Tester Jul 24, 2010, 17:38	Well it's still in the documentation, or it was yesterday, haven't checked today.
No.07484 AWJ Developer Jun 2, 2011, 16:09	Replaced the bad ROM with a hand-fixed one.