<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Divinity: Original Sin Enhanced Edition(Native) crash on start"
href="https://bugs.freedesktop.org/show_bug.cgi?id=93551#c6">Comment # 6</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Divinity: Original Sin Enhanced Edition(Native) crash on start"
href="https://bugs.freedesktop.org/show_bug.cgi?id=93551">bug 93551</a>
from <span class="vcard"><a class="email" href="mailto:smidjar2.reg@email.cz" title="smidjar2.reg@email.cz">smidjar2.reg@email.cz</a>
</span></b>
<pre>I disassembled ApplyConstants() where the game crashes when using OpenGL
override to 4.2. It is indeed a game bug, caused by possible NULL dereference.
Crash occurs at line marked by =>
0x00007ffff48467e0 <+0>: push r15
0x00007ffff48467e2 <+2>: push r14
0x00007ffff48467e4 <+4>: push r12
0x00007ffff48467e6 <+6>: push rbx
0x00007ffff48467e7 <+7>: push rax
0x00007ffff48467e8 <+8>: mov r14,rdi
0x00007ffff48467eb <+11>: mov eax,DWORD PTR [r14+0x6f8]
0x00007ffff48467f2 <+18>: mov rcx,QWORD PTR [rip+0xd297] #
0x7ffff4853a90
0x00007ffff48467f9 <+25>: cmp eax,DWORD PTR [rcx]
0x00007ffff48467fb <+27>: je 0x7ffff4846959
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+377>
0x00007ffff4846801 <+33>: xor r15d,r15d
0x00007ffff4846804 <+36>: test eax,0x3ff0000
0x00007ffff4846809 <+41>: je 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff484680b <+43>: movzx ecx,ax
0x00007ffff484680e <+46>: mov edx,DWORD PTR [r14+0xc4]
0x00007ffff4846815 <+53>: xor r15d,r15d
0x00007ffff4846818 <+56>: cmp rcx,rdx
0x00007ffff484681b <+59>: jae 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff484681d <+61>: shr eax,0x10
0x00007ffff4846820 <+64>: mov rdx,QWORD PTR [r14+0xe0]
0x00007ffff4846827 <+71>: xor r15d,r15d
0x00007ffff484682a <+74>: movzx edx,WORD PTR [rdx+rcx*2]
0x00007ffff484682e <+78>: and eax,0x3ff
0x00007ffff4846833 <+83>: cmp eax,edx
0x00007ffff4846835 <+85>: jne 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff4846837 <+87>: imul r15,rcx,0x110
0x00007ffff484683e <+94>: add r15,QWORD PTR [r14+0xb8]
=> 0x00007ffff4846845 <+101>: mov rcx,QWORD PTR [r15+0x10]
......
//0x00007ffff48467eb:
eax = this->variable_at_offset_0x6f8
//0x00007ffff48467f2:
rcx = some_related_global_or_static_variable
//0x00007ffff48467fb:
if (eax != rcx) {
// 0x00007ffff4846801:
r15 = NULL
if ((eax & 0x3ff0000) != 0) {
// ...
// r15 is set in this block to valid value
// ...
}
// 0x00007ffff4846845:
rcx = r15->variable_at_offset_0x10 // crash here because r15 can be NULL
}
// function end</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>