Host crash (SIGSEGV) loading UK_Brighton routes 1, 2 and UK_London_Hackney route 1 #13

New issue

Closed

opened 2026-10-18 14:11:20 +00:00 by mintopia · 3 comments

mintopia commented

2026-10-18 14:11:20 +00:00

Owner

Two host crashes (SIGSEGV) seen while automating loading-screen captures on 2026-10-18 (recomp engine, develop @ 56048f6 + uncommitted BLUR_TEX_DUMP WIP in src/d3d9metal).

Observed

UK_Brighton_1: [host] HOST CRASH signal 11 addr=0x2000700020011
UK_Brighton_2: [host] HOST CRASH signal 11 addr=0x2000900020011
UK_Brighton_0 and UK_Brighton_3 (and every other route tried so far) reached the loading screen fine.
Fault addresses are non-canonical and differ only in one byte (07 vs 09), which looks like a packed value or pair of small ints being dereferenced as a pointer.

How it was reached (caveat: not a normal player path)

Driver: tools/modes/mdrive.py with the dev patch (tools/modes/devpatch) plus an extra UIGlobals.post.lua that wraps GameData.GetEvent and overrides city_id, route_id, route_tag, city_tag, route_name, city_name, city_icon_name with the target route, then starts the first career event and presses Enter until Screens/Loading/.
So the game was asked to load Brighton route 1/2 inside an event that doesn't normally use them. The crash may be caused by that override (e.g. route incompatible with the event's mode / car class / AI setup) rather than a port bug.
Crash logs were not kept (the per-run log is overwritten).

To do

Reproduce through a normal path: pick Brighton route 1 and 2 in Quick/Arcade race or a multiplayer custom race (no GetEvent override). If it doesn't crash there, close as a driver artifact and note the incompatible override in the driver.
If it reproduces: capture the host crash dump / thread backtrace, map the faulting recompiled function to the Blur.exe address, and find what produced the bogus pointer.
Add a regression check (e.g. an mdrive plan that loads both routes) once fixed.

Two host crashes (SIGSEGV) seen while automating loading-screen captures on 2026-10-18 (recomp engine, develop @ 56048f6 + uncommitted BLUR_TEX_DUMP WIP in src/d3d9metal). **Observed** - `UK_Brighton_1`: `[host] HOST CRASH signal 11 addr=0x2000700020011` - `UK_Brighton_2`: `[host] HOST CRASH signal 11 addr=0x2000900020011` - `UK_Brighton_0` and `UK_Brighton_3` (and every other route tried so far) reached the loading screen fine. - Fault addresses are non-canonical and differ only in one byte (07 vs 09), which looks like a packed value or pair of small ints being dereferenced as a pointer. **How it was reached (caveat: not a normal player path)** - Driver: `tools/modes/mdrive.py` with the dev patch (`tools/modes/devpatch`) plus an extra `UIGlobals.post.lua` that wraps `GameData.GetEvent` and overrides `city_id, route_id, route_tag, city_tag, route_name, city_name, city_icon_name` with the target route, then starts the first career event and presses Enter until `Screens/Loading/`. - So the game was asked to load Brighton route 1/2 inside an event that doesn't normally use them. The crash may be caused by that override (e.g. route incompatible with the event's mode / car class / AI setup) rather than a port bug. - Crash logs were not kept (the per-run log is overwritten). **To do** 1. Reproduce through a normal path: pick Brighton route 1 and 2 in Quick/Arcade race or a multiplayer custom race (no GetEvent override). If it doesn't crash there, close as a driver artifact and note the incompatible override in the driver. 2. If it reproduces: capture the host crash dump / thread backtrace, map the faulting recompiled function to the Blur.exe address, and find what produced the bogus pointer. 3. Add a regression check (e.g. an mdrive plan that loads both routes) once fixed.

mintopia added the

needs-triage

label

2026-10-18 14:11:20 +00:00

mintopia commented

2026-10-18 14:28:33 +00:00

Author

Owner

Third crash, same circumstances (2026-10-18): UK_London_Hackney_1 also crashed the host with signal 11 while the driver forced route data onto the career event card via the GameData.GetEvent override. Not seen on UK_London_Hackney_0. Crash log not kept. Include Hackney route 1 in the normal-path repro (step 1).

Third crash, same circumstances (2026-10-18): `UK_London_Hackney_1` also crashed the host with signal 11 while the driver forced route data onto the career event card via the `GameData.GetEvent` override. Not seen on `UK_London_Hackney_0`. Crash log not kept. Include Hackney route 1 in the normal-path repro (step 1).

mintopia changed title from ~~Host crash (SIGSEGV) loading UK_Brighton routes 1 and 2~~ to Host crash (SIGSEGV) loading UK_Brighton routes 1, 2 and UK_London_Hackney route 1

2026-10-18 14:28:33 +00:00

mintopia self-assigned this

2026-10-19 11:24:04 +00:00

mintopia commented

2026-10-19 12:28:32 +00:00

Author

Owner

Not a port bug: driver artifact. Reproduced the SIGSEGV with the GetEvent override (Brighton_1, also with a whole other event record swapped in): guest passes a non-wrapper pointer (index/string data) as the vertex buffer to SetStreamSource during Loading; engine still loads the real event, so the override leaves loading screen inconsistent. Normal path works: real career events load to HUD with no crash: tier 1 ev 3 = UK_Brighton_1, tier 1 ev 7 = UK_Brighton_2, tier 5 ev 4 = UK_London_Hackney_1 (confirmed via GameData.GetEvent route_tag + HUD screenshot). Added tools/modes/plans/career_route.py (ROUTE_TIER/ROUTE_EV) as the regression plan, and a warning in tools/trackcards/capture.py that the card override must not run past SpPreRace. Commit 1a50530. Full unit suite not run (no code changes under src).

Not a port bug: driver artifact. Reproduced the SIGSEGV with the GetEvent override (Brighton_1, also with a whole other event record swapped in): guest passes a non-wrapper pointer (index/string data) as the vertex buffer to SetStreamSource during Loading; engine still loads the real event, so the override leaves loading screen inconsistent. Normal path works: real career events load to HUD with no crash: tier 1 ev 3 = UK_Brighton_1, tier 1 ev 7 = UK_Brighton_2, tier 5 ev 4 = UK_London_Hackney_1 (confirmed via GameData.GetEvent route_tag + HUD screenshot). Added tools/modes/plans/career_route.py (ROUTE_TIER/ROUTE_EV) as the regression plan, and a warning in tools/trackcards/capture.py that the card override must not run past SpPreRace. Commit 1a50530. Full unit suite not run (no code changes under src).

mintopia closed this issue

2026-10-19 12:29:26 +00:00

mintopia commented

2026-10-19 12:29:26 +00:00

Author

Owner

Completed and merged by Harmonic (task 13).

mintopia referenced this issue from a commit

2026-10-19 12:29:57 +00:00

Add career_route mdrive plan (real Brighton/Hackney route loads); warn that capture.py card override must not run past SpPreRace (#13)

mintopia referenced this issue

2026-10-20 22:25:12 +00:00