Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
07503 Crash/Freeze Critical (emulator) Always Nov 27, 2019, 09:38 Oct 31, 2021, 12:42
Tester Robbbert View Status Public Platform MAME (Self-compiled)
Assigned To Resolution Open OS Windows Vista/7/8 (64-bit)
Status [?] Confirmed Driver snes.cpp
Version 0.216 Fixed in Version Build 64-bit
Fixed in Git Commit Github Pull Request #
Summary MESS-specific 07503: snes, snespal: Assorted titles crash upon launch
Description The following sets crash Mame, with a dump usually consisting of '--------------------------'.

aryol, bluesb, bluesbu, nipachim, ranmagek, tecmonbaj, tecmonbaja, tecmonbau, tecmonbaup, yuyu, yuyua.


Mariopnt, mariopntu produce a black screen and a continual tone at startup.


In 0.209, these games all worked, except for mariopnt(u), which produced a black screen with a tune.
Steps To Reproduce these sets are all in the software list, so

>mame64 snes <item-name>
or
>mame64 snespal <item-name>

will suffice.
Additional Information Some sets show other bugs before the crash occurs.

bluesb, bluesbu - the title screen is squashed into the top half.

ranmagek - (snes) the screen is squashed into the top half, and duplicated in the bottom half. (snespal) crashes at start.

yuyu - the screen bounces slightly up and down before crashing.

This is the only dump I was able to get:
C:\MAME>mame snespal ranmagek

-----------------------------------------------------
Exception at EIP=0000000005981255 (screen_device::create_composited_bitmap()+0x0195): ACCESS VIOLATION
While attempting to write memory at 00000000249d0000
-----------------------------------------------------
RAX=0000000000004000 RBX=000000000000026f RCX=0000000012012e40 RDX=0000000000000000
RSI=00000000000002aa RDI=000000001ce54760 RBP=0000000000000270 RSP=0000000000228f48
 R8=00000000010ec000 R9=0000000000000000 R10=00000000249d0004 R11=0000000001550000
R12=0000000012013538 R13=000000000ddeee30 R14=00000000000000b0 R15=000000000dabdff0
-----------------------------------------------------
Stack crawl:
  0000000000228f80: 0000000005981255 (screen_device::create_composited_bitmap()+0x0195)
  0000000000228fd0: 0000000005981468 (screen_device::update_quads()+0x01d8)
  0000000000229050: 00000000059b7f7a (video_manager::finish_screen_updates()+0x019a)
  00000000002290d0: 00000000059b94e8 (video_manager::frame_update(bool)+0x0158)
  0000000000229130: 0000000005980df7 (screen_device::vblank_begin()+0x01e7)
  00000000002291a0: 0000000005984835 (screen_device::device_timer(emu_timer&, unsigned int, int, void*)+0x0175)
  00000000002291e0: 0000000005978dda (emu_timer::device_timer_expired(emu_timer&, void*, int)+0x002a)
  0000000000229270: 000000000597c5ca (device_scheduler::timeslice()+0x015a)
  00000000002293e0: 0000000005934e38 (running_machine::run(bool)+0x0288)
  000000000022f090: 0000000003cb5710 (mame_machine_manager::execute()+0x01e0)
  000000000022f350: 0000000003d2c8f7 (cli_frontend::start_execution(mame_machine_manager*, std::vector<std::__cxx11::basic_string<char, std::c
har_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > c
onst&)+0x01b7)
  000000000022f640: 0000000003d2ccb6 (cli_frontend::execute(std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocato
r<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >&)+0x0056)
  000000000022f6a0: 0000000003cb34c7 (emulator_info::start_frontend(emu_options&, osd_interface&, std::vector<std::__cxx11::basic_string<char,
 std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>
> > >&)+0x0027)
  000000000022fe50: 000000000a0f3037 (main+0x0187)
  000000000022ff20: 00000000004013a5 (__tmainCRTStartup+0x0225)
  000000000022ff50: 000000000040150b (mainCRTStartup+0x001b)
  000000000022ff80: 0000000076e3556d (BaseThreadInitThunk+0x000d)
  000000000022ffd0: 0000000076f9385d (RtlUserThreadStart+0x001d)
Github Commit
Flags
Regression Version
Affected Sets / Systems snes, snespal
Attached Files
? file icon 07503.diff (543 bytes) Mar 19, 2020, 06:18 Uploaded by AmatCoder
[Show Content]
Relationships
related to 07556ResolvedAmatCoder  snes, snespal [ctrigger and clones]: chrono trigger consistently causes segfault 
Notes
6
User avatar
No.17383
Firewave
Senior Tester
Feb 2, 2020, 10:06
edited on: Feb 2, 2020, 10:35
snespal -cart ranmagek
==21176==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x46151180 at pc 0x05cb0e44 bp 0x166fb79c sp 0x166fb790
WRITE of size 4 at 0x46151180 thread T0
    #0 0x5cb0e43 in screen_device::create_composited_bitmap s:\dev\mame0217\src\emu\screen.cpp:1741
    #1 0x5cb9441 in screen_device::update_quads s:\dev\mame0217\src\emu\screen.cpp:1768
    #2 0x6146b76 in video_manager::finish_screen_updates s:\dev\mame0217\src\emu\video.cpp:863
    #3 0x614709d in video_manager::frame_update s:\dev\mame0217\src\emu\video.cpp:217
    #4 0x5cb99d2 in screen_device::vblank_begin s:\dev\mame0217\src\emu\screen.cpp:1660
    #5 0x5cb1cf5 in screen_device::device_timer s:\dev\mame0217\src\emu\screen.cpp:959
    #6 0x5fa7a0d in emu_timer::device_timer_expired s:\dev\mame0217\src\emu\schedule.cpp:317
    #7 0x5fa80ac in device_scheduler::execute_timers s:\dev\mame0217\src\emu\schedule.cpp:907
    #8 0x5fab12e in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:544
    #9 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
    #10 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
    #11 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
    #12 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
    #13 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
    #14 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
    #15 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #16 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)
    #17 0x76f17b73 in RtlGetAppContainerNamedObjectPath+0xe3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b73)
    #18 0x76f17b43 in RtlGetAppContainerNamedObjectPath+0xb3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b43)

0x46151180 is located 0 bytes to the right of 1702272-byte region [0x45fb1800,0x46151180)
allocated by thread T0 here:
    #0 0xc728bd in operator new[] D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\asan\asan_new_delete.cc:102
    #1 0x1c80fcb in bitmap_t::allocate s:\dev\mame0217\src\lib\util\bitmap.cpp:249
    #2 0x1c819a7 in bitmap_t::resize s:\dev\mame0217\src\lib\util\bitmap.cpp:289
    #3 0x5cb4f3a in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1129
    #4 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
    #5 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
    #6 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
    #7 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
    #8 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
    #9 0x1b8feab in snes_console_state::snes20_lo_w+0x9b (s:\dev\mame0217\mame.exe+0x1bcfeab)
    #10 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
    #11 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
    #12 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
    #13 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
    #14 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
    #15 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
    #16 0x8e49cbf in g65816_device::g65816i_8d_E+0xdf (s:\dev\mame0217\mame.exe+0x8e89cbf)
    #17 0x8e53315 in g65816_device::g65816i_execute_M1X1+0x335 (s:\dev\mame0217\mame.exe+0x8e93315)
    #18 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
    #19 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
    #20 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
    #21 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
    #22 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
    #23 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
    #24 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
    #25 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
    #26 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #27 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)

SUMMARY: AddressSanitizer: heap-buffer-overflow s:\dev\mame0217\src\emu\screen.cpp:1741 in screen_device::create_composited_bitmap
Shadow bytes around the buggy address:
  0x38c2a1e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x38c2a1f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x38c2a200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x38c2a210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x38c2a220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x38c2a230:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x38c2a240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x38c2a250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x38c2a260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x38c2a270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x38c2a280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable: 00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone: fa
  Freed heap region: fd
  Stack left redzone: f1
  Stack mid redzone: f2
  Stack right redzone: f3
  Stack after return: f5
  Stack use after scope: f8
  Global redzone: f9
  Global init order: f6
  Poisoned by user: f7
  Container overflow: fc
  Array cookie: ac
  Intra object redzone: bb
  ASan internal: fe
  Left alloca redzone: ca
  Right alloca redzone: cb
  Shadow gap: cc
==21176==ABORTING

snespal -cart aryol
==20324==ERROR: AddressSanitizer: negative-size-param: (size=-4)
    #0 0xc622a8 in __asan_wrap_memmove D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\sanitizer_common\sanitizer_common_interceptors.inc:784
    #1 0x5caf437 in screen_device::allocate_scan_bitmaps s:\dev\mame0217\src\emu\screen.cpp:666
    #2 0x5cb50c2 in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1140
    #3 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
    #4 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
    #5 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
    #6 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
    #7 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
    #8 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
    #9 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
    #10 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
    #11 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
    #12 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
    #13 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
    #14 0x8e49cbf in g65816_device::g65816i_8d_E+0xdf (s:\dev\mame0217\mame.exe+0x8e89cbf)
    #15 0x8e53315 in g65816_device::g65816i_execute_M1X1+0x335 (s:\dev\mame0217\mame.exe+0x8e93315)
    #16 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
    #17 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
    #18 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
    #19 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
    #20 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
    #21 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
    #22 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
    #23 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
    #24 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #25 0x75d06358 in BaseThreadInitThunk+0x18 (C:\WINDOWS\System32\KERNEL32.DLL+0x6b816358)
    #26 0x76f17b73 in RtlGetAppContainerNamedObjectPath+0xe3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b73)
    #27 0x76f17b43 in RtlGetAppContainerNamedObjectPath+0xb3 (C:\WINDOWS\SYSTEM32\ntdll.dll+0x4b2e7b43)

0x462cf7d4 is located 1876 bytes inside of 2844-byte region [0x462cf080,0x462cfb9c)
allocated by thread T0 here:
    #0 0xc724cd in operator new D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\asan\asan_new_delete.cc:99
    #1 0xc781f1 in std::_Allocate<8,std::_Default_allocate_traits,0>+0x71 (s:\dev\mame0217\mame.exe+0xcb81f1)
    #2 0x5c15f5b in std::vector<char32_t,std::allocator<char32_t> >::_Emplace_reallocate<char32_t const &> C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.24.28314\include\vector:745
    #3 0x5caf331 in screen_device::allocate_scan_bitmaps s:\dev\mame0217\src\emu\screen.cpp:651
    #4 0x5cb50c2 in screen_device::realloc_screen_bitmaps s:\dev\mame0217\src\emu\screen.cpp:1140
    #5 0x5cb082a in screen_device::configure s:\dev\mame0217\src\emu\screen.cpp:1024
    #6 0x7fb6a2f in snes_ppu_device::dynamic_res_change+0x24f (s:\dev\mame0217\mame.exe+0x7ff6a2f)
    #7 0x7fbcd60 in snes_ppu_device::write+0xd60 (s:\dev\mame0217\mame.exe+0x7ffcd60)
    #8 0x1bcfa98 in snes_state::snes_w_io+0x48 (s:\dev\mame0217\mame.exe+0x1c0fa98)
    #9 0x1b8f70a in snes_console_state::snes20_hi_w+0x38a (s:\dev\mame0217\mame.exe+0x1bcf70a)
    #10 0x1b8feab in snes_console_state::snes20_lo_w+0x9b (s:\dev\mame0217\mame.exe+0x1bcfeab)
    #11 0xc7b99b in delegate_mfp::method_stub<brazehs<tpp2_noalu_state>,void,address_space &,unsigned int,unsigned char,unsigned char>+0x1b (s:\dev\mame0217\mame.exe+0xcbb99b)
    #12 0x6158390 in handler_entry_write_delegate<0,0,0,emu::device_delegate<void __cdecl(address_space &,unsigned int,unsigned char,unsigned char)> >::write s:\dev\mame0217\src\emu\emumem_hedp.cpp:140
    #13 0x699e170 in handler_entry_write_dispatch<24,0,0,0>::write s:\dev\mame0217\src\emu\emumem_hedw.ipp:52
    #14 0x5f810b4 in address_space_specific<0,0,0>::write_native s:\dev\mame0217\src\emu\emumem.cpp:610
    #15 0x5f7bdd4 in address_space_specific<0,0,1>::write_byte s:\dev\mame0217\src\emu\emumem.cpp:630
    #16 0x7bc8c56 in g65816_device::g65816i_write_8_normal+0xe6 (s:\dev\mame0217\mame.exe+0x7c08c56)
    #17 0x8e4a843 in g65816_device::g65816i_9f_E+0xe3 (s:\dev\mame0217\mame.exe+0x8e8a843)
    #18 0x8e501b5 in g65816_device::g65816i_execute_M1X0+0x335 (s:\dev\mame0217\mame.exe+0x8e901b5)
    #19 0x7bc6063 in g65816_device::execute_run+0x53 (s:\dev\mame0217\mame.exe+0x7c06063)
    #20 0x5faacb7 in device_scheduler::timeslice s:\dev\mame0217\src\emu\schedule.cpp:495
    #21 0x5fb9530 in running_machine::run s:\dev\mame0217\src\emu\machine.cpp:372
    #22 0x6e59e64 in mame_machine_manager::execute S:\dev\mame0217\src\frontend\mame\mame.cpp:261
    #23 0x6e79b2a in cli_frontend::start_execution S:\dev\mame0217\src\frontend\mame\clifront.cpp:267
    #24 0x6e71754 in cli_frontend::execute S:\dev\mame0217\src\frontend\mame\clifront.cpp:283
    #25 0x6e5ad79 in emulator_info::start_frontend S:\dev\mame0217\src\frontend\mame\mame.cpp:392
    #26 0xa0f24ae in main s:\dev\mame0217\src\osd\windows\winmain.cpp:323
    #27 0x9e96df8 in __scrt_common_main_seh d:\agent\_work\6\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288

SUMMARY: AddressSanitizer: negative-size-param D:\agent\_work\6\s\src\vctools\crt\asan\llvm\compiler-rt\lib\sanitizer_common\sanitizer_common_interceptors.inc:784 in __asan_wrap_memmove
==20324==ABORTING
User avatar
No.17490
Robbbert
Developer
Mar 16, 2020, 00:51
Is the failure commit and version known?

If it's related to 7593, can they be joined in a relationship?
User avatar
No.17494
AmatCoder
Tester
Mar 19, 2020, 06:37
It is not related to 07593.

Into "allocate_scan_bitmaps()" function you are removing elements from "m_scan_bitmaps" vector which changes the size. This lead to accessing elements beyond your list.

I have uploaded a diff file just as an example of how to fix it.
User avatar
No.19231
thankyoumame
Tester
Sep 6, 2021, 01:24
Please test smashten too. MAME crashes when I try to launch it.
User avatar
No.19390
hap
Developer
Oct 29, 2021, 14:14
Amat's crash fix is applied here: https://github.com/mamedev/mame/commit/41a80334ce442a42b4f62d64713534d9ad722145

The gfx bugs in "Additional Information" are part of this bug report?
If not, this bug can be set to resolved.
User avatar
No.19408
Robbbert
Developer
Oct 31, 2021, 12:42
Tested all these games. All crashes have been fixed. Some other issues remain though.

bluesb, bluesbu - the title screen is squashed into the top half.

ranmagek - the screen is squashed into the top half, and duplicated in the bottom half.

mariopnt, mariopntu - play a short tune followed by a tone - appears to have hung.

These matters can be put into a new report if you think it would be better.