07456: eswat: Segmentation fault

ID	Category [?]	Severity [?]	Reproducibility	Date Submitted	Last Update
07456	Crash/Freeze	Critical (emulator)	Sometimes	Oct 19, 2019, 01:19	Oct 21, 2019, 12:43

Tester	AJR	View Status	Public	Platform	MAME (Self-compiled)
Assigned To	smf	Resolution	Fixed	OS	MacOS X
Status [?]	Resolved			Driver	sega/segas16b.cpp
Version	0.214	Fixed in Version	0.215	Build	64-bit
		Fixed in Git Commit		Github Pull Request #

Summary	07456: eswat: Segmentation fault
Description	The driver sometimes crashes with "Segmentation fault" or "Abort trap" as it starts.
Steps To Reproduce	This bug does not always occur, and tends not to be reproducible when using -debug. When it does crash, it crashes very quickly.
Additional Information	Further investigation has shown that the crash occurs more or less immediately after a call to sega_315_5195_mapper_device::update_mapping (not the first such call, though), and before the first screen update. Since the crash has not been observed in versions prior to 0.200, the problem is conjectured to lie somewhere in between the rewrite of MAME's memory system and the way the device callback abuses it to dynamically remap areas.
Github Commit

Flags
Regression Version	0.200
Affected Sets / Systems	eswat

Attached Files

No.17102 NekoEd Senior Tester Oct 20, 2019, 09:25	I tried booting it at least 20 times and I couldn't reproduce it on SDLMAME/Linux x64 0.214
No.17103 M.A.S.H. Senior Tester Oct 20, 2019, 10:31	I could not reproduce it either on Windows 10 (64-bit) or Windows XP. AJR can you test it again with an official compiled file like http://sdlmame.lngn.net/mame0214-64bit.zip Extract zip in a directory and copy eswat.zip in the roms dir and start. No further changes! It may have something to do with your program setting in your self-compiled MAME version?
No.17104 AJR Developer Oct 20, 2019, 14:18	I just downloaded the precompiled binary from M.A.S.H.'s link. The same crash occurred the first, fourth and fifth times I tried it with eswat.
No.17105 Robbbert Senior Tester Oct 20, 2019, 14:49	Unable to reproduce on Windows 7. Maybe it's a OS/X-only issue.
No.17106 Tafoid Administrator Oct 20, 2019, 15:03	MAME 0.214 DEBUG=1 build always asserts for me: F:\OLDER_MAME>mamed214 eswat Assertion failed! Program: F:\OLDER_MAME\mamed214.exe File: ../../../../../src/emu/tilemap.cpp, Line 950 Expression: dest.cliprect().contains(cliprect)
No.17107 AJR Developer Oct 20, 2019, 17:07 edited on: Oct 20, 2019, 17:18	The tilemap assert is a different problem which I've already addressed (and originally confused this with). The crash shows up in non-debug reference builds I have going back to 0.200. My hypothesis is that the memory system is somehow deallocating the memory share objects and/or backing RAM as the mapper repeatedly removes and remaps them, and this leads to OS-specific heap corruption. I think this could be tested by allocating the RAM in the driver instead.
No.17110 AJR Developer Oct 21, 2019, 12:42	Fixed in 02f39608f22896ec76a1e26720a1d0f3fd0862b7.