It actually seems less consistent than I thought - I still get a crash 100% of the time, but not always at the exact same time.
- First scenario where it always happened: previous track was Fern Bay Green, I changed that to Blackwood BL1. Vehicle was Reaper bike (stock), with a grid of 20 AI which I cleared to ride alone. Race was set to 20 laps. The game crashed after pressing the Go button, while loading (towards the end, just before displaying the game).
- Second scenario: BL1X, alone on the Reaper bike (stock), 20 laps (no checkpoints). Crash happens after the hairpin, before the chicane.
- Third scenario (somewhat different): from scenario 1 or 2, changing the vehicle (to XRR or BF1, only tried those 2), crash happens while confirming car choice or even before that, while moving the mouse.
- Fourth scenario: I went back to Fern Bay to avoid the car selection crash, switched to XRR, then went back to BL1X, practice. The game crashes as soon as I'm done turning after exiting the garage (I tried going the wrong way as well, same result). It's almost as if something in the field of view causes it.
As for the crash address/offset, I'll have a look if I can get that, running from wine I'm not sure how to open the Windows event viewer. I do have 2 crash dumps from wine itself, but nothing in there looks like the address/offset you want. As a side note, I'm on an old PC right now, not my main PC, not sure how relevant it could be, but I had D45 on that same old PC working with no issue.
I will try and downgrade to D45 and check that none of this happens, just to be sure.
Below is part of one of the crash dumps:
Unhandled exception: page fault on write access to 0x00000000 in 32-bit code (0x6ab275f5).
Register dump:
CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
EIP:6ab275f5 ESP:054cf7e4 EBP:054cf808 EFLAGS:00010206( R- -- I - -P- )
EAX:00000000 EBX:1e62ef00 ECX:0016850c EDX:00000000
ESI:1fe00030 EDI:00000000
Stack dump:
0x054cf7e4: 1e5f4b88 054cf8b8 6ab2f0be 00000000
0x054cf7f4: 1fe00030 0016850c 1e62ef00 054cf8b8
0x054cf804: 1e5f4b88 1e62ee08 03424875 00000000
0x054cf814: 1fe00030 0016850c 40002000 00008892
0x054cf824: 1e5f4b88 012d7884 034425cf 012d7884
0x054cf834: 012a0f30 00000002 00000001 012c73cc
Backtrace:
=>0 0x6ab275f5 in ucrtbase (+0x675f5) (0x054cf808)
1 0x6ab2f0be memcpy+0x4e(dst=0x000000000, src=1FE00030, n=0x16850c) [Z:\usr\src\packages\BUILD\dlls\msvcrt\string.c:3063] in ucrtbase (0x054cf808)
2 0x03424875 wined3d_context_gl_unmap_bo_address(context_gl=012A0F30, dst=054CF8B8, src=054CF8B0, range_count=0x1, ranges=1E62EF00) [Z:\usr\src\packages\BUILD\dlls\wined3d\context_gl.c:3125] in wined3d (0x1e62ee08)
3 0x03424875 wined3d_context_gl_copy_bo_address+0x1a5(context_gl=012A0F30, dst=054CF8B8, src=054CF8B0, range_count=0x1, ranges=1E62EF00) [Z:\usr\src\packages\BUILD\dlls\wined3d\context_gl.c:3124] in wined3d (0x1e62ee08)
4 0x0341710f wined3d_context_copy_bo_address+0x47(ranges=<internal error>, range_count=<internal error>, src=<internal error>, dst=<internal error>, context=<internal error>) [Z:\usr\src\packages\BUILD\dlls\wined3d\wined3d_private.h:6589] in wined3d (0x1e62ee08)
5 0x0341710f wined3d_buffer_load_location+0x38f(buffer=1E62EE08, context=012A0F30, location=0x8) [Z:\usr\src\packages\BUILD\dlls\wined3d\buffer.c:666] in wined3d (0x1e62ee08)
6 0x0341866a wined3d_buffer_load+0x19a(buffer=1E62EE08, context=012A0F30, state=04AC002C) [Z:\usr\src\packages\BUILD\dlls\wined3d\buffer.c:902] in wined3d (0x012a0f30)
7 0x0341aa68 context_update_stream_info+0x148(context=012A0F30, state=<is not available>) [Z:\usr\src\packages\BUILD\dlls\wined3d\context.c:306] in wined3d (0x00000000)
8 0x034271ba context_apply_draw_state+0x20c(indexed=<internal error>, state=<internal error>, device=<internal error>, context=<internal error>) [Z:\usr\src\packages\BUILD\dlls\wined3d\context_gl.c:4244] in wined3d (0x012a0f30)
9 0x034271ba draw_primitive+0x43a(device=<is not available>, state=<is not available>, parameters=<is not available>) [Z:\usr\src\packages\BUILD\dlls\wined3d\context_gl.c:5151] in wined3d (0x012a0f30)
10 0x03437ab6 wined3d_cs_exec_draw+0xe6(cs=04AC0020, data=04DA6B00) [Z:\usr\src\packages\BUILD\dlls\wined3d\cs.c:1006] in wined3d (0x00000000)
11 0x0343b4bb wined3d_cs_command_unlock(queue=<internal error>, cs=<internal error>) [Z:\usr\src\packages\BUILD\dlls\wined3d\cs.c:3308] in wined3d (0x054cff28)
12 0x0343b4bb wined3d_cs_execute_next+0x53(ctx=<couldn't compute location>) [Z:\usr\src\packages\BUILD\dlls\wined3d\cs.c:3307] in wined3d (0x054cff28)
13 0x0343b4bb wined3d_cs_run+0x13b(ctx=<couldn't compute location>) [Z:\usr\src\packages\BUILD\dlls\wined3d\cs.c:3374] in wined3d (0x054cff28)
14 0x7b629ee0 in kernel32 (+0x29ee0) (0x054cff48)
15 0x7bc5c6e7 in ntdll (+0x5c6e7) (0x054cff5c)
16 0x7bc5cef0 RtlCreateUserThread(entry=0343B380, arg=04AC0020) [Z:\usr\src\packages\BUILD\dlls\ntdll\thread.c:306] in ntdll (0x054cffec)
0x6ab275f5 ucrtbase+0x675f5: movq %mm0,0x0(%edi)
And some thread info regarding LFS:
00000158 (D) C:\LFS\LFS.exe
0000015c 0
00000160 0 <== wined3d_cs
00000164 0
00000168 15 winepulse_mainloop
0000016c 15 winepulse_timer_loop
00000170 15 wine_dsound_mixer
00000180 0