CydandClaude Opus 5
6467a5f930
The podium crash dies in SocketIterator::DeletePlugs, calling through a segment whose vtable dword has been replaced by a small float. The three dumps prove the segment is wrong BY teardown; nothing in them says when it went wrong, and six configurations of the local repro rig - parked pods, driven pods, light and full page heap, two, four and six pods - reached the podium and tore down clean. So the next real playtest becomes the instrument. RP412SEGCHECK walks the segment table in ~JointedMover before the delete, guarded-reads each segment's first dword, and if one does not match the vtable captured from the very first segment ever built it writes the forensics into rpl4-fail.log, which is closed on the way down and survives the abort - rpl4.log does not. The report carries the entity and whether it was the local pod, which index went bad and what is in it, the first two rows of the object as hex and float, and the heap deltas to its neighbours on either side. Three bracket calls in the winners' circle answer the question the dumps cannot: at podium entry, and either side of the second MakeEntityRenderables on the own pod. Whichever fires first is recorded and travels inside the teardown report, so the log says whether the race broke the segment or the podium did. It deliberately does not skip the delete or repair the pointer. The ownership bug is unfixed and a guard would cost exactly the evidence this is here to collect - it stops on the same object, one step earlier, holding the forensics. On by default, a handful of pointer compares per pod per race; RP412SEGCHECK=0 turns it off, and the environ.ini template says so. tools/podium-repro is the rig itself, banked with what the dumps already established: page heap turned on through the PEB without gflags or elevation, N sandboxed installs, and a feeder that drives full races through them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
30 lines
1.3 KiB
Plaintext
30 lines
1.3 KiB
Plaintext
# RP412INPUTSCRIPT - "crashlap": drive hard and hit things.
|
|
#
|
|
# The sterile six-pod run (pods parked on their pads for 45 s) reached the
|
|
# podium with 6 placed and tore down clean under page heap - no crash. The
|
|
# fatal playtest differed in that its pods were DRIVEN: they collided, took
|
|
# damage, died and respawned. Damage matters to this bug's neighbourhood -
|
|
# a destroyed segment swaps its video object (DestroyedGraphicState), which
|
|
# is the segment machinery the crash lives in - and death/respawn runs
|
|
# VTV::Reset mid-race.
|
|
#
|
|
# So: full throttle into a hard turn, held, so the pod leaves the track and
|
|
# keeps ramming terrain for the whole race. Pedals yaw it further off line.
|
|
# Blunt on purpose - the goal is contact and damage, not a clean lap.
|
|
#
|
|
# Times are SIMULATION seconds from the green light; each row holds until
|
|
# the next.
|
|
#
|
|
# t throttle stickX stickY pedals
|
|
0.0 0.0 0 0 0
|
|
1.0 1.0 0 0 0
|
|
4.0 1.0 0.85 0 0.6
|
|
9.0 1.0 -0.85 0 -0.6
|
|
14.0 1.0 0.9 0.4 0.8
|
|
19.0 1.0 -0.9 -0.4 -0.8
|
|
24.0 1.0 0.85 0 0.6
|
|
29.0 1.0 -0.85 0 -0.6
|
|
34.0 1.0 0.9 0.4 0.8
|
|
39.0 1.0 -0.9 -0.4 -0.8
|
|
44.0 1.0 0.85 0 0.6
|