Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
06600 Crash/Freeze Critical (emulator) Sometimes Jun 3, 2017, 00:06 Jan 1, 2018, 20:39
Tester AJR View Status Public Platform MAME (Self-compiled)
Assigned To Resolution Open OS MacOS X
Status [?] Confirmed Driver model1.cpp
Version 0.186 Fixed in Version Build 64-bit
Summary 06600: netmerc: Segmentation fault
Description The game sometimes exits with "Segmentation fault: 11" a few seconds after emulation starts, sometimes on the region warning screen and sometimes when exiting MAME.
Steps To Reproduce Start the machine.
Additional Information Yes, Sega NetMerc is tagged MACHINE_NOT_WORKING (as is its closest relation, Wing War), but even that is no excuse for emulator crashes.
Flags
Regression Version
Affected Sets / Systems netmerc
Attached Files
 
Relationships
There are no relationship linked to this issue.
Notes
3
User avatar
No.13877
B2K24
Moderator
Jun 3, 2017, 04:36
edited on: Jun 3, 2017, 04:41
Exception at EIP=00000000044ab0ef (address_table_setoffset::~address_table_setoffset()+0x003f): ACCESS VIOLATION
While attempting to read memory at ffffffffffffffff
-----------------------------------------------------
RAX=3f70f0f13e7cfcfd RBX=000000001801e7a8 RCX=000000001ff586c0 RDX=0000000000000000
RSI=000000001801e238 RDI=000000001801dd58 RBP=000000000b678680 RSP=000000000b678600
R8=00000000001c24c0 R9=0000000000008000 R10=00000000001c0cc0 R11=0000000018022850
R12=000000000b678720 R13=000000000b678770 R14=0000000009fe2100 R15=000000000b678780
-----------------------------------------------------
Stack crawl:
000000000b6785c0: 00000000044ab0ef (address_table_setoffset::~address_table_setoffset()+0x003f)
000000000b678680: 00000000044964bb (address_space_specific<unsigned short, (endianness_t)1, true>::~address_space_specific()+0x002b)
000000000b6786e0: 00000000031cedee (running_machine::~running_machine()+0x041e)
000000000b67f430: 0000000001beed50 (mame_machine_manager::execute()+0x01f0)
000000000b67f530: 0000000001c4d255 (cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>,std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x01d5)
000000000b67f6a0: 0000000001c4d445 (cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0045)
000000000b67f700: 0000000001beceba (emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x002a)
000000000b67fdb0: 0000000001b43142 (utf8_main(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0122)
000000000b67fe50: 00000000037451b9 (wmain+0x0169)
000000000b67ff20: 0000000000401410 (__tmainCRTStartup+0x0260)
000000000b67ff50: 000000000040153b (mainCRTStartup+0x001b)
000000000b67ff80: 00007ffb31dc8364 (BaseThreadInitThunk+0x0014)
000000000b67ffd0: 00007ffb348970d1 (RtlUserThreadStart+0x0021)
User avatar
No.14595
Firewave
Senior Tester
Dec 31, 2017, 23:57
edited on: Jan 1, 2018, 20:43
==119150==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x617000017604 at pc 0x000003f2a9ba bp 0x7ffea14cb790 sp 0x7ffea14cb788
WRITE of size 4 at 0x617000017604 thread T0
    #0 0x3f2a9b9 in set_lightparam /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1267:23
    #1 0x3f2a9b9 in model1_state::tgp_render(bitmap_rgb32&, rectangle const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1396
    #2 0x3f2c4b5 in model1_state::screen_update_model1(screen_device&, bitmap_rgb32&, rectangle const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1660:2
    #3 0xe7ac0e2 in operator() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/delegate.h:544:11
    #4 0xe7ac0e2 in screen_device::update_partial(int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1220
    #5 0xe833c67 in video_manager::finish_screen_updates() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:694:10
    #6 0xe8332a0 in video_manager::frame_update(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:208:27
    #7 0xe7a9f66 in vblank_end /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1556:21
    #8 0xe7a9f66 in screen_device::device_timer(emu_timer&, unsigned int, int, void*) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/screen.cpp:1002
    #9 0xe795168 in timer_expired /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/device.h:520:83
    #10 0xe795168 in device_scheduler::execute_timers() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:906
    #11 0xe78ea0f in device_scheduler::timeslice() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/schedule.cpp:530:2
    #12 0xe6a324b in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:357:17
    #13 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #14 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #15 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #16 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #17 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #18 0x7f943897082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #19 0x1431838 in _start (/mnt/mame/mame64+0x1431838)

0x617000017604 is located 0 bytes to the right of 644-byte region [0x617000017380,0x617000017604)
allocated by thread T0 here:
    #0 0x14fd8a2 in operator new[](unsigned long) /opt/media/clang_nightly/llvm/utils/release/final/llvm.src/projects/compiler-rt/lib/asan/asan_new_delete.cc:95:3
    #1 0xf13f7e6 in bitmap_t::allocate(int, int, int, int) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/lib/util/bitmap.cpp:210:16
    #2 0xe6f6b6b in render_font::char_expand(char32_t, render_font::glyph&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:718:13
    #3 0xe6fe874 in render_font::get_char(char32_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:539:4
    #4 0xe6f7e57 in render_font::char_width(float, float, char32_t) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/rendfont.cpp:851:15
    #5 0x919aa71 in get_char_width /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:316:16
    #6 0x919aa71 in ui::text_layout::line::add_character(char32_t, ui::text_layout::char_style const&, ui::text_layout::source_info const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:530
    #7 0x9199fdb in ui::text_layout::add_text(char const*, ui::text_layout::char_style const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.cpp:185:20
    #8 0x8d9199b in add_text /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/text.h:77:3
    #9 0x8d9199b in draw_text_box /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:611
    #10 0x8d9199b in mame_ui_manager::handler_messagebox_anykey(render_container&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:789
    #11 0x8da3ed9 in operator()<render_container &, void> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:600:11
    #12 0x8da3ed9 in __call<unsigned int, render_container &, 0, 1> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1073
    #13 0x8da3ed9 in operator()<render_container &, unsigned int> /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1131
    #14 0x8da3ed9 in std::_Function_handler<unsigned int (render_container&), std::_Bind<std::_Mem_fn<unsigned int (mame_ui_manager::*)(render_container&)> (mame_ui_manager*, std::_Placeholder<1>)> >::_M_invoke(std::_Any_data const&, render_container&) /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:1856
    #15 0x8d92475 in operator() /usr/lib/gcc/x86_64-linux-gnu/5.4.0/../../../../include/c++/5.4.0/functional:2267:14
    #16 0x8d92475 in mame_ui_manager::update_and_render(render_container&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:414
    #17 0x8cd3cb9 in emulator_info::draw_user_interface(running_machine&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:347:41
    #18 0xe833354 in video_manager::frame_update(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/video.cpp:220:2
    #19 0x8d8e1e9 in mame_ui_manager::display_startup_screens(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/ui/ui.cpp:350:22
    #20 0x8cd2d73 in mame_machine_manager::ui_initialize(running_machine&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:298:8
    #21 0xe6a2f9a in running_machine::run(bool) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/emu/machine.cpp:332:13
    #22 0x8cd10e0 in mame_machine_manager::execute() /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:236:19
    #23 0x8e1e0d3 in cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:257:22
    #24 0x8e20ee0 in cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/clifront.cpp:273:3
    #25 0x8cd3717 in emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&) /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/frontend/mame/mame.cpp:336:18
    #26 0x8acddf2 in main /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/osd/sdl/sdlmain.cpp:216:9
    #27 0x7f943897082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-buffer-overflow /mnt/mame/build/projects/sdl/mame/gmake-linux-clang/../../../../../src/mame/video/model1.cpp:1267:23 in set_lightparam
Shadow bytes around the buggy address:
  0x0c2e7fffae70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffae90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffaea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c2e7fffaeb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c2e7fffaec0:[04]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffaed0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c2e7fffaee0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaef0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaf00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c2e7fffaf10: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
User avatar
No.14598
Firewave
Senior Tester
Jan 1, 2018, 20:39
edited on: Jan 1, 2018, 20:42
../../../../../src/mame/video/model1.cpp:1265:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1266:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1267:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'
../../../../../src/mame/video/model1.cpp:1268:2: runtime error: index 128 out of bounds for type 'model1_state::lightparam_t [32]'

And later on these happen (the first two could be caused by the out of bounds writes though).
../../../../../3rdparty/glm/glm/detail/func_exponential.inl:132:34: runtime error: division by zero
../../../../../src/devices/cpu/v60/op2.hxx:205:7: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:80:11: runtime error: 1.12339e+10 is outside the range of representable values of type 'int'
../../../../../src/mame/video/model1.cpp:78:15: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:79:15: runtime error: division by zero
../../../../../src/mame/video/model1.cpp:81:11: runtime error: -inf is outside the range of representable values of type 'int'

And while we're at it - before the machine even starts running (before the warning screen) there's these (unrelated) warnings:
../../../../../src/devices/sound/multipcm.cpp:572:49: runtime error: division by zero
../../../../../src/devices/sound/multipcm.cpp:572:22: runtime error: inf is outside the range of representable values of type 'unsigned int'
../../../../../src/devices/sound/multipcm.cpp:573:56: runtime error: division by zero
../../../../../src/devices/sound/multipcm.cpp:573:29: runtime error: inf is outside the range of representable values of type 'unsigned int'