[Bug 93551] Divinity: Original Sin Enhanced Edition(Native) crash on start

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=93551

--- Comment #6 from smidjar2.reg at email.cz ---
I disassembled ApplyConstants() where the game crashes when using OpenGL
override to 4.2. It is indeed a game bug, caused by possible NULL dereference.
Crash occurs at line marked by =>

   0x00007ffff48467e0 <+0>:    push   r15
   0x00007ffff48467e2 <+2>:    push   r14
   0x00007ffff48467e4 <+4>:    push   r12
   0x00007ffff48467e6 <+6>:    push   rbx
   0x00007ffff48467e7 <+7>:    push   rax
   0x00007ffff48467e8 <+8>:    mov    r14,rdi
   0x00007ffff48467eb <+11>:    mov    eax,DWORD PTR [r14+0x6f8]
   0x00007ffff48467f2 <+18>:    mov    rcx,QWORD PTR [rip+0xd297]        #
0x7ffff4853a90
   0x00007ffff48467f9 <+25>:    cmp    eax,DWORD PTR [rcx]
   0x00007ffff48467fb <+27>:    je     0x7ffff4846959
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+377>
   0x00007ffff4846801 <+33>:    xor    r15d,r15d
   0x00007ffff4846804 <+36>:    test   eax,0x3ff0000
   0x00007ffff4846809 <+41>:    je     0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff484680b <+43>:    movzx  ecx,ax
   0x00007ffff484680e <+46>:    mov    edx,DWORD PTR [r14+0xc4]
   0x00007ffff4846815 <+53>:    xor    r15d,r15d
   0x00007ffff4846818 <+56>:    cmp    rcx,rdx
   0x00007ffff484681b <+59>:    jae    0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff484681d <+61>:    shr    eax,0x10
   0x00007ffff4846820 <+64>:    mov    rdx,QWORD PTR [r14+0xe0]
   0x00007ffff4846827 <+71>:    xor    r15d,r15d
   0x00007ffff484682a <+74>:    movzx  edx,WORD PTR [rdx+rcx*2]
   0x00007ffff484682e <+78>:    and    eax,0x3ff
   0x00007ffff4846833 <+83>:    cmp    eax,edx
   0x00007ffff4846835 <+85>:    jne    0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
   0x00007ffff4846837 <+87>:    imul   r15,rcx,0x110
   0x00007ffff484683e <+94>:    add    r15,QWORD PTR [r14+0xb8]
=> 0x00007ffff4846845 <+101>:    mov    rcx,QWORD PTR [r15+0x10]
   ......


//0x00007ffff48467eb:
  eax = this->variable_at_offset_0x6f8
//0x00007ffff48467f2:
  rcx = some_related_global_or_static_variable
//0x00007ffff48467fb:
  if (eax != rcx) {
    // 0x00007ffff4846801:
    r15 = NULL
    if ((eax & 0x3ff0000) != 0) {
       // ...
       // r15 is set in this block to valid value
       // ...
    }
    // 0x00007ffff4846845:
    rcx = r15->variable_at_offset_0x10 // crash here because r15 can be NULL
  }
// function end

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20160331/a340b2f3/attachment.html>