https://bugs.freedesktop.org/show_bug.cgi?id=93551
--- Comment #6 from smidjar2.reg at email.cz ---
I disassembled ApplyConstants() where the game crashes when using OpenGL
override to 4.2. It is indeed a game bug, caused by possible NULL dereference.
Crash occurs at line marked by =>
0x00007ffff48467e0 <+0>: push r15
0x00007ffff48467e2 <+2>: push r14
0x00007ffff48467e4 <+4>: push r12
0x00007ffff48467e6 <+6>: push rbx
0x00007ffff48467e7 <+7>: push rax
0x00007ffff48467e8 <+8>: mov r14,rdi
0x00007ffff48467eb <+11>: mov eax,DWORD PTR [r14+0x6f8]
0x00007ffff48467f2 <+18>: mov rcx,QWORD PTR [rip+0xd297] #
0x7ffff4853a90
0x00007ffff48467f9 <+25>: cmp eax,DWORD PTR [rcx]
0x00007ffff48467fb <+27>: je 0x7ffff4846959
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+377>
0x00007ffff4846801 <+33>: xor r15d,r15d
0x00007ffff4846804 <+36>: test eax,0x3ff0000
0x00007ffff4846809 <+41>: je 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff484680b <+43>: movzx ecx,ax
0x00007ffff484680e <+46>: mov edx,DWORD PTR [r14+0xc4]
0x00007ffff4846815 <+53>: xor r15d,r15d
0x00007ffff4846818 <+56>: cmp rcx,rdx
0x00007ffff484681b <+59>: jae 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff484681d <+61>: shr eax,0x10
0x00007ffff4846820 <+64>: mov rdx,QWORD PTR [r14+0xe0]
0x00007ffff4846827 <+71>: xor r15d,r15d
0x00007ffff484682a <+74>: movzx edx,WORD PTR [rdx+rcx*2]
0x00007ffff484682e <+78>: and eax,0x3ff
0x00007ffff4846833 <+83>: cmp eax,edx
0x00007ffff4846835 <+85>: jne 0x7ffff4846845
<_ZN3api14OpenGLRenderer14ApplyConstantsEv+101>
0x00007ffff4846837 <+87>: imul r15,rcx,0x110
0x00007ffff484683e <+94>: add r15,QWORD PTR [r14+0xb8]
=> 0x00007ffff4846845 <+101>: mov rcx,QWORD PTR [r15+0x10]
......
//0x00007ffff48467eb:
eax = this->variable_at_offset_0x6f8
//0x00007ffff48467f2:
rcx = some_related_global_or_static_variable
//0x00007ffff48467fb:
if (eax != rcx) {
// 0x00007ffff4846801:
r15 = NULL
if ((eax & 0x3ff0000) != 0) {
// ...
// r15 is set in this block to valid value
// ...
}
// 0x00007ffff4846845:
rcx = r15->variable_at_offset_0x10 // crash here because r15 can be NULL
}
// function end
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/dri-devel/attachments/20160331/a340b2f3/attachment.html>
