Viewing Issue Advanced Details
ID Category [?] Severity [?] Reproducibility Date Submitted Last Update
04352 Crash/Freeze Critical (emulator) Always May 16, 2011, 17:32 May 25, 2011, 15:34
Tester Kale View Status Public Platform
Assigned To Ryan Holtz Resolution Fixed OS
Status [?] Resolved Driver
Version 0.142u3 Fixed in Version 0.142u5 Build
Fixed in Git Commit Github Pull Request #
Summary 04352: xexex: Crash during Mask Rom Test
Description When attempting a mask rom text in service mode, you'll notice a countdown. When it has counted down to "02", MAME crashes.
Program received signal SIGSEGV, Segmentation fault.
0x00db4c14 in k056832_rom_word_r (device=0x267a24, offset=0, mem_mask=65280)
    at src/mame/video/konicdev.c:6472
6472 ret = (rombase[ofs8 + 4]<<8);

-

#0 0x00db4c14 in k056832_rom_word_r (device=0x267a24, offset=0,
    mem_mask=65280) at src/mame/video/konicdev.c:6472
#1 0x025f15f3 in handler_entry_read::read_stub_legacy (this=0x1d8fb9a4,
    space=..., offset=0, mask=65280) at src/emu/memory.c:4730
#2 0x02fe4318 in delegate_base<unsigned short, address_space&, unsigned int, un
signed short, _noparam>::operator() (this=0x1d8fb9ec, p1=..., p2=0, p3=65280)
    at src/emu/delegate.h:582
#3 0x02fef26d in handler_entry_read::read16 (this=0x1d8fb9a4, space=...,
    offset=0, mask=65280) at src/emu/memory.c:527
#4 0x02f7f519 in address_space_specific<unsigned short, (endianness_t)1, true>:
:read_native (this=0x1d8f16bc, offset=0, mask=65280) at src/emu/memory.c:1112
#5 0x02f7ecd9 in address_space_specific<unsigned short, (endianness_t)1, true>:
:read_direct<unsigned char, true> (this=0x1d8f16bc, address=1638400,
    mask=255 '\377') at src/emu/memory.c:1209
#6 0x02f805a4 in address_space_specific<unsigned short, (endianness_t)1, true>:
:read_byte (this=0x1d8f16bc, address=1638400) at src/emu/memory.c:1441
#7 0x02fe414e in delegate_base<unsigned char, unsigned int, _noparam, _noparam,
 _noparam>::operator() (this=0x1cae1b6c, p1=1638400)
    at src/emu/delegate.h:580
#8 0x02494f4e in m68ki_read_8_fc (m68k=0x1cae1930, address=1638400, fc=1)
    at src/emu/cpu/m68000/m68kcpu.h:1004
#9 0x02495499 in OPER_AY_AI_8 (m68k=0x1cae1930)
    at src/emu/cpu/m68000/m68kcpu.h:1204
#10 0x024c57ac in m68k_op_move_8_d_ai (m68k=0x1cae1930)
    at obj/windows/mamed/emu/cpu/m68000/m68kops.c:15779
#11 0x01f3a3a2 in cpu_execute_m68k (device=0x26d00c)
    at src/emu/cpu/m68000/m68kcpu.c:645
#12 0x028e2605 in legacy_cpu_device::execute_run (this=0x26d00c)
    at src/emu/devcpu.c:260
#13 0x025d7c5e in device_scheduler::timeslice (this=0x22f580)
    at src/emu/schedule.c:466
#14 0x025dbc6d in running_machine::run (this=0x22f0f8, firstrun=true)
    at src/emu/machine.c:414
#15 0x0260de07 in mame_execute (options=..., osd=...) at src/emu/mame.c:176
#16 0x028c7fb5 in cli_frontend::execute (this=0x22fed0, argc=4, argv=0x3f47e8)
    at src/emu/clifront.c:184
#17 0x01e96c0d in utf8_main (argc=4, argv=0x3f47e8)
    at src/osd/windows/winmain.c:422
#18 0x02ae8baa in wmain (argc=4, argv=0x3f42f8) at src/osd/windows/main.c:82
#19 0x004013d1 in __tmainCRTStartup () at ../mingw-w64-crt/crt/crtexe.c:268
#20 0x7c817077 in RegisterWaitForInputIdle ()
   from C:\WINDOWS\system32\kernel32.dll
Steps To Reproduce
Additional Information
Github Commit
Flags
Regression Version 0.70
Affected Sets / Systems xexex
Attached Files
 
Relationships
There are no relationship linked to this issue.
Notes
2
User avatar
No.07448
Tafoid
Administrator
May 16, 2011, 17:49
edited on: May 16, 2011, 17:50
0.70 is the first broken main version. I tested binaries for 0.69a, 0.69b and 0.69u3 (first version with U usage) and all of them tested OK.

The readme suggests:
General Konami Updates [Acho A. Tang, R. Belmont]

That's pretty vague. There is an entry in mameinfo.dat for the game:
- 0.70: Changed Z80 CPU2 clock speed to 8MHz.

Without examining the source bases, it's hard to tell what happened.
User avatar
No.07449
Haze
Senior Tester
May 16, 2011, 19:31
Well based on the backtrace it's almost certainly reading past the end of rom ;-)

intentionally (buggy game code checking unused space / mirrored rom) or a broken function is another matter entirely.