37e42aafc4
Two live cdb captures on the paired 2013 client at the Holtburg doorway: the blockset template (every Render::block_check call of one frame — 2,601 resident blocks x 2 exit views) proves retail tests a9c9 at ring slot 25,46 and returns PARTIALLY then OUTSIDE; the blockcheck template dumps its four corner interval vectors (0 0 0 0 300.4|310.2 and 0 0 0 1001 ..., slab 75..330). acdream's replay at the same P pose reproduces the sentinel pattern, the four edge planes and both verdicts, drawing a9c9 once, with clip heights 298.8/308.5 m — a 0.5 % plane difference (about 0.35 px of projected door-vertex position). At the fixture pose that margin is what flips the south-west corner from inside to outside on the fourth edge plane, so retail's four-corner unanimity test says OUTSIDE where ours says PartiallyInside. Not fixable bit-exactly short of D3D's x87 transform; the KnownFailure row stays with its comment rewritten, the register carries AD-118, and the first filtered capture's silent miss (cdb sign-extends poi() inside .if; use dwo()) is noted in the template. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
46 lines
2.9 KiB
Text
46 lines
2.9 KiB
Text
* OH walk-oracle capture: BLOCK CHECK (2026-09-03, for docs/ISSUES.md #458).
|
|
* Prints, for ONE land block (default 0xA9C9FFFF = block a9c9, the doorway
|
|
* divergence), every Render::block_check @0x0054dc50 call LScape::draw_check_blocks
|
|
* @0x00505f80 makes for it: the four corner interval vectors (32 dwords each,
|
|
* raw IEEE-754 — bounds[0] = the CY plane, bounds[1..n] = the active view's
|
|
* edge planes; see WalkVisibilityMath.FillClipHeights), the block's z slab
|
|
* (max_zval, min_zval — raw dwords), the grid indices (caller's ebx = x,
|
|
* ebp = y), and the returned BoundingType at the call's return site
|
|
* 0x005061e9 (0 OUTSIDE, 1 PARTIALLY_INSIDE, 2 ENTIRELY_INSIDE).
|
|
*
|
|
* Register facts (VERIFY IN RECON with `dt acclient!CLandBlock` and by `u
|
|
* 005061df`): Render::block_check is a static __cdecl (args on the stack at
|
|
* entry: esp+4 west_y, esp+8 west_y+1, esp+0xc east_y, esp+0x10 east_y+1,
|
|
* esp+0x14 max_zval, esp+0x18 min_zval); at entry esi/ebx/ebp still hold the
|
|
* caller's esi_3 (CLandBlock*), ebx_3 (grid x) and ebp_8 (grid y) —
|
|
* callee-saved registers untouched at the first instruction. CLandBlock's
|
|
* m_DID sits at +0x28 (DBObj first base, same as CEnvCell — FW0-proven).
|
|
*
|
|
* LINE FORMATS:
|
|
* F <n> -- frame marker (SmartBox::RenderNormalMode)
|
|
* P <cell> <ox> <oy> <oz> <qw> <qx> <qy> <qz> -- viewer pose, raw dwords
|
|
* BC did=<hex> gx=<n> gy=<n> max=<hex> min=<hex>
|
|
* W0 <32 dwords> / W1 <32 dwords> / E0 <32 dwords> / E1 <32 dwords>
|
|
* BR ret=<n> -- the BoundingType returned for that call
|
|
*
|
|
* AUTO-DETACH: same fall-through + top-level qd recipe as the walk template.
|
|
* BEFORE USE: replace <FRAMES> and <LOG>; change 0xa9c9ffff for another block.
|
|
|
|
.logopen <LOG>
|
|
.sympath C:\Users\erikn\source\repos\acdream\refs
|
|
.symopt+ 0x40
|
|
.reload /f acclient.exe
|
|
r $t0 = 0
|
|
r $t8 = 0
|
|
bp 00453aa0 "r $t0 = @$t0 + 1; .printf \"F %d\\n\", @$t0; .printf \"P %08x %08x %08x %08x %08x %08x %08x %08x\\n\", poi(0081ef00+4), poi(0081ef00+0x3c), poi(0081ef00+0x40), poi(0081ef00+0x44), poi(0081ef00+8), poi(0081ef00+0xc), poi(0081ef00+0x10), poi(0081ef00+0x14); .if (@$t0 < 0n<FRAMES>) { gc }"
|
|
* NOTE (2026-09-03, first run): `poi(...) == 0xa9c9ffff` never matched — cdb
|
|
* sign-extends the 32-bit read inside `.if`, so the equality is false for any
|
|
* DID with the top bit set. `dwo(...)` reads an unsigned dword; the blockset
|
|
* template proved the register facts (did=a9c9ffff at gx=25 gy=46, twice a
|
|
* frame for the two doorway views).
|
|
bp 0054dc50 ".if (dwo(@esi+0x28) == 0xa9c9ffff) { r $t8 = 1; .printf \"BC did=%08x gx=%d gy=%d max=%08x min=%08x\\n\", dwo(@esi+0x28), @ebx, @ebp, dwo(@esp+0x14), dwo(@esp+0x18); .printf \"W0\"; dd poi(@esp+4) L20; .printf \"W1\"; dd poi(@esp+8) L20; .printf \"E0\"; dd poi(@esp+0xc) L20; .printf \"E1\"; dd poi(@esp+0x10) L20 }; gc"
|
|
bp 005061e9 ".if (@$t8 == 1) { .printf \"BR ret=%d\\n\", @eax; r $t8 = 0 }; gc"
|
|
g
|
|
.echo ===DETACHING===
|
|
qd
|
|
.logclose
|