CTD, SexLabUtil.dll+0x26690

[Guest]

Test character is currently in Bannered Mare when a SL animation is about to start with a dog. Initiating script is most likely Aroused Creatures. CTD is repeatable 100% of the time. Tested more than 10 times trying to debug this myself.

 

Error is 0x5 ACCESS_DENIED

Memory at 0x50 could not be read.

 

Faulting instruction is:

movss   xmm0, dword ptr [rdx+50h]

rdx at the time is 0x0.

 

Using SL 163 BETA8.

SexLabUtil.dll checksum: 22577532eacc4c94d16d31a7135db1e1

 

Unfortunately I do not know much about this sub that contains the faulting address. The frame before entering SexLabUtil.dll is in SkyrimSE.exe, however the offset in SkyrimSE.exe keeps moving around. IDA7 does not see this connection, it is only visible in x64dbg which to me makes it seem like a dynamically placed hook (i.e. it is only there when the game is running). So I guess it might be close to a hook.

 

The faulting offset (0x26690) is called from 0x26A29 which exists in a sub that starts at SexLabUtil.dll+0x268F0. This sub (0x268F0) is the one that is called from SkyrimSE.exe (as mentioned above).

 

I set breakpoints on SexLabUtil.dll+0x26690 and SexLabUtil.dll+0x268F0 and looked through every instruction until it crashed at 0x26690. I saw no hints in the registers or the stack as to what it might have been doing before it crashed. Pretty much the only thing I got out of it was that starting at the faulting offset (0x26690) the code is using almost solely the xmm registers. I am even less familiar with 64 bit assembly than 32 bit, but to my knowledge the xmm registers are mainly used for specific workloads. Sometimes back in the day when they were added, I recall it was to speed up media processing on the cpu. Obviously not saying SL is trying to play me a video here, my point is it might for instance be working with floating points or the like, something the xmm registers are "good at".

 

Considering this might be a "null pointer" issue (rdx is null). The papyrus log may provide some hints since it is full errors thrown because of None references.

 

So, any ideas on this one?

Papyrus.0.log SexLabDebug.0.log

[Zaflis]

Sorry but where did you download this SexlabUtil for SSE anyways? Shouldn't it be reported there?

 

Also for a second you got me confused with Skyrim Utility Mod, they are different right?

[Guest]

SexLabUtil.dll is part of SL:

https://www.loverslab.com/topic/91861-sexlab-framework-se-163-beta-8-november-22nd-2019/

 

EDIT: I might be able to do this myself if I could maybe get a debug build of SexLabUtil.dll and the associated pdb file. Those are not available publicly are they?

[Guest]

I added lots of TraceStack and Trace calls all around related SL methods. Pretty sure this issue stems from SL trying to stop threads while AC is setting up an animation. sslActorAlias gets cleared while AC is waiting for the actors to walk over to eachother. When the animation should start the actor references are gone and it breaks. There doesn't appear to be anything blocking the PickModel method from handing out references to threads that later get cleared by StopThread, mainly because StopAll doesn't mark/lock the threads in any way. Not sure that would be enough though considering papyrus seems to be multithreaded, at least to some extent. It's all a race condition basically.

 

I did uncomment the actual StopAll call in sslSystemAlias but it changed nothing for my test save. I didn't look into it any further than that, just assumed the save was made when SL was already killing the threads and thus uncommenting that wouldn't stop what was already happening.

 

Also for what it's worth, I made a proxy script of SexLabUtil (created a copy and renamed the original SexLabUtil2) and added logging to all native methods in there. I saw no lines in the log related to native methods being called at all, the others I did see so I know my proxy was working at least to that extent. So, either skyrim didn't flush the log before it died, or there is something else going on here. Point is I still don't know what method is causing the crash.

 

I "solved" the issue by loading an earlier save and just not saving the game while AC is about to start an animation. This is bound to happen again however, so I will probably have to fix this properly at some point myself. Not sure how yet tho. Currently I would however recommend a few things that should mitigate the chances:

1. Don't save too quickly after a load screen. StopAll is called on load (game load or entering a cell through a loading screen).
2. Make sure SL is set to teleport actors. The window for it to break becomes way too large if it has to wait for actors to walk to eachother.

[Zaflis]

I just checked the versions, the SL you linked uses the DLL made for SKSE 2.0.17. However latest version of that is 2.0.19. You can still find SKSE 2.0.17 in its download sites archive, but that only works with earlier Skyrim SE version...

 

At least i'd recommend setting SkyrimSE to not automatically update by Steam. Only when you are ready to upgrade all dll's of all mods you have with those, including SKSE.

 

Anyway, i suggest discussing the rest with people who have experience on the subject:

https://www.loverslab.com/topic/91861-sexlab-framework-se-163-beta-8-november-22nd-2019/page/243/