Running Perfect Dark 1.1 against Ricevideo on Nvidia/Linux causes segfault

[GoogleCodeExporter]

Describe your system:
 - Linux distribution:  openSUSE 10.3
 - Machine type: (32-bit or 64-bit) 64-bit
 - Mupen64Plus version: r750
 - Plugins used: Ricevideo

For visual artifacts, give:
 - Also, there are visual artifacts on the main console - I mention this
here because it may be related.  See attached screenshot for example of the
artifacts seen in the main menu (but not at the time of the crash).  The
screenshot shows a snap of what normally looks like flickering - the blue
areas flick on and off at high rate during this intro sequence.  In most
areas, it doesn't happen badly enough to worry about, but I can see
occasional areas of blue between polygons.

These artifacts only happen with ricevideo - other video plugins seem to
work OK (although I can dupe another reported video issue with sky areas
having weird artifacts as well) but don't perform as well.  Ricevideo works
best for me from a performance standpoint.

Describe the problem:

Running the level "A51 Infiltration", segfaults occur if standing too close
to an object that explodes (not close enough for damage to occur to the
character, but close enough to see detail in the explosion).

Please provide any additional information below.

Attaching gdb shows the following information:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x41046950 (LWP 22216)]
0x00002aaaacc5a201 in CTextureManager::ClampT32 ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so

Backtrace follows:

#0  0x00002aaaacc5a201 in CTextureManager::ClampT32 ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#1  0x00002aaaacc5b83e in CTextureManager::ExpandTexture ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#2  0x00002aaaacc5b955 in CTextureManager::ExpandTextureT ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#3  0x00002aaaacc5c5ba in CTextureManager::GetTexture ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#4  0x00002aaaacc567f1 in LoadTexture ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#5  0x00002aaaacc56a22 in PrepareTextures ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#6  0x00002aaaacc5822a in RSP_Tri4_PD ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#7  0x00002aaaacc55489 in DLParser_Process ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#8  0x00002aaaacc320db in ProcessDListStep2 ()
   from /usr/local/share/mupen64plus/plugins/ricevideo.so
#9  0x00002aaaac9cebd8 in DoRspCycles ()
   from /usr/local/share/mupen64plus/plugins/mupen64_hle_rsp_azimer.so
#10 0x00000000004566a7 in update_SP ()
#11 0x000000000046620f in SW ()
#12 0x00000000004833d9 in JR ()
---Type <return> to continue, or q <return> to quit--- 
#13 0x0000000000468d3d in go ()
#14 0x0000000000420ec4 in ?? ()
#15 0x00002ab6f849f020 in start_thread () from /lib64/libpthread.so.0
#16 0x00002ab6fae3ef8d in clone () from /lib64/libc.so.6
#17 0x0000000000000000 in ?? ()

Startup console output:

Version 1.4-trunk-r750 

Config Dir: "/home/sjones/.mupen64plus/", Install Dir:
"/usr/local/share/mupen64plus/"
Rescanning rom cache.
Scanning... /home/sjones/Downloads/Mupen64Plus-1-4-bin-64/
Rom cache up to date. 12 ROMs.
Compression: Uncompressed
Imagetype: .z64 (native)
Rom size: 33554432 bytes (or 32 Mb or 256 Megabits)
MD5: E03B088B6AC9E0080440EFED07C1E40F
80 37 12 40
ClockRate = f
Version: 1449
CRC: 41f2b98f b458b466
Name: Perfect Dark
Manufacturer: Nintendo
Cartridge_ID: 4450
Country: Unknown (0x145)
PC = 80001000
EEPROM type: 1
init timer!
memory initialized
[RiceVideo] SSE processing enabled.
[blight's SDL input plugin]: version 0.0.10 initialized.
[RiceVideo] SSE processing enabled.
[RiceVideo] Found ROM 'Perfect Dark', CRC 8fb9f24166b458b4-45
InitExternalTextures
Texture loading option is enabledFinding all hires texturesInitializing
OpenGL Device Context
(II) Initializing SDL video subsystem...
(II) Getting video info...
(II) Setting video mode 1024x768...
NVIDIA Corporation - GeForce 6150 LE/PCI/SSE2 : 2.1.2 NVIDIA 169.09
[RiceVideo] OpenGL Combiner: Fragment Program
[JttL's SDL Audio plugin] version 1.4-trunk/jttl_audio-r750  initalizing.
[JttL's SDL Audio plugin] Initializing SDL audio subsystem...
[JttL's SDL Audio plugin] Allocating memory for audio buffer: 65536 bytes.
Starting r4300 emulator
R4300 Core mode: Interpreter
R4300 core finished.
[JttL's SDL Audio plugin] Cleaning up SDL sound plugin...
[RiceVideo] Found ROM 'Perfect Dark', CRC 8fb9f24166b458b4-45
[blight's SDL input plugin]: Closing...
Rom cache system terminated!

Original issue reported on code.google.com by sjone...@gmail.com on 11 Jul 2008 at 10:23

Attachments:

• sampleartifacts.png

[GoogleCodeExporter]

Seems it's not just a51 infiltration that this happens in, pretty much anytime 
an
explosion happens where the texture is largely exposed this segfault can happen.

Is any additional information needed?  I have also tried this with newer builds
(currently at r677) and it still occurs (not surprising, as ricevideo doesn't 
seem to
have been updated).

Original comment by sjone...@gmail.com on 15 Jul 2008 at 8:26

[GoogleCodeExporter]

I would like to take a look at this problem.  Can you update to the head of the 
trunk
and grab a savestate right before the crash happens, then post it here?

Original comment by richard...@gmail.com on 15 Jul 2008 at 10:37

• Changed state: Accepted

[GoogleCodeExporter]

Thanks, Rich - not sure what you mean by "update to the head of the trunk", but 
I can
grab a savestate later today and post it for you with instructions on how to 
duplicate.

Original comment by sjone...@gmail.com on 16 Jul 2008 at 5:33

[GoogleCodeExporter]

I took a guess that you meant to update my SVN build, so I did that - attached 
is the
savestate.  To duplicate, just shoot the turret until it explodes while using 
the
Ricevideo video plugin.  Version running now is r783.

Original comment by sjone...@gmail.com on 16 Jul 2008 at 7:24

Attachments:

• pdss.zip

[GoogleCodeExporter]

Thanks for reporting this bug and posting the state file.  I replicated the 
crash and
ran it in gdb to find the source of the segfault.  It turns out that the
CTextureManager::ClampT32() function in rice video is being called with a 
negative
value or 0 for the uint32-typed 'height' parameter.  I added a parameter check 
to
this function and 3 others which could be affected by the same problem.  I 
tested
against the savestate and couldn't make it crash; the fix is committed in rev 
788.

Original comment by richard...@gmail.com on 19 Jul 2008 at 5:12

• Changed state: Fixed

[GoogleCodeExporter]

Thanks for the fix here - I do get a different crash now running the fixed code.

(gdb) bt
#0  0x00002aaaad369504 in CheckTextureInfos ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#1  0x00002aaaad369797 in LoadHiresTexture ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#2  0x00002aaaad37fd4e in PrepareTextures ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#3  0x00002aaaad38122a in RSP_Tri4_PD ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#4  0x00002aaaad37e489 in DLParser_Process ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#5  0x00002aaaad35b0db in ProcessDListStep2 ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so
#6  0x00002aaaac5c6bd8 in DoRspCycles ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/mupen64_hle_rsp_azimer.so
#7  0x00000000004557d7 in update_SP ()
#8  0x000000000046533f in SW ()
#9  0x0000000000482769 in JR ()
#10 0x000000000046814f in r4300_execute ()
#11 0x000000000041fed4 in ?? ()
#12 0x00002ac370be8020 in start_thread () from /lib64/libpthread.so.0
#13 0x00002ac373587f8d in clone () from /lib64/libc.so.6
#14 0x0000000000000000 in ?? ()

The crash reported in gdb is:

Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0x41046950 (LWP 24368)]
0x00002aaaad369504 in CheckTextureInfos ()
   from /home/jhenderson/Downloads/mupen64plus/trunk/plugins/ricevideo.so

Same state file does this.  Does it make a difference that I'm running a build 
for
64-bit systems?

Original comment by sjone...@gmail.com on 19 Jul 2008 at 8:33

[GoogleCodeExporter]

These are probably 64-bit specific crashes.  So you're using hi-res textures 
too? 
Can you upload the pack here or give a link where to download the hi-res pack?

Original comment by richard...@gmail.com on 19 Jul 2008 at 10:59

[GoogleCodeExporter]

Ah, I have high res textures turned on "if available", but to my knowledge, I 
didn't
actually install any high-res textures.  Turning that option off in the 
Ricevideo
plugin got rid of the second crash.

Thanks - a few other minor bugs exist running PD under mupen64plus, I'll submit 
them
separately, though.

Original comment by sjone...@gmail.com on 20 Jul 2008 at 2:55