57b5e43d0e
Five bugs identified and patched in retail Asheron's Call client: - v3b: palette refcount over-increment (3-byte NOP at two sites) - v5: RenderSurface PurgeResource no-op stub (vtable slot 2 thunk) - v11: two dangling-pointer crash guards (NULL-check + reorder) - v14: CEnvCell::Destroy ClipPlaneList leak (18-byte JMP to cleanup thunk) - v22: unpacker stale-pointer SEH guard (whole-function __try/__except) All five ship in leakfix.dll (117 KB, SHA d282f23c…) which is loaded by acclient.exe at process start via PE import table patching by tools/install_leakfix.py. Controlled 15-client fleet soak: unpatched control died at 26h with palette exhaustion; all 14 patched clients survived past that point and reached ≥5-day uptime. Residual ~15 MB/h growth traced to d3d9.dll's internal slab allocator (260KB surface backing buffers retained after Release). See REPORT.md §10 for the full investigation; conclusion is that it's unfixable from outside d3d9. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
74 lines
2.1 KiB
Python
74 lines
2.1 KiB
Python
"""probe_gmui_size.py <dump.dmp>
|
|
|
|
Measure spacing between adjacent gm*UI instances in the same region
|
|
to derive a real per-instance allocation size.
|
|
"""
|
|
import struct, sys
|
|
from minidump.minidumpfile import MinidumpFile
|
|
from collections import Counter
|
|
|
|
|
|
GM_NOTICE_VT = 0x007ccb60
|
|
GM_NOTICE_OFFSET = 0x5f8
|
|
|
|
|
|
def _ei(v):
|
|
if v is None: return 0
|
|
if hasattr(v, 'value'): return int(v.value)
|
|
return int(v)
|
|
|
|
|
|
md = MinidumpFile.parse(sys.argv[1])
|
|
reader = md.get_reader().get_buffered_reader()
|
|
scan = []
|
|
for r in md.memory_info.infos:
|
|
st, ty, pr = _ei(r.State), _ei(r.Type), _ei(r.Protect) & 0xff
|
|
if st != 0x1000 or ty == 0x1000000 or pr not in (0x04, 0x40): continue
|
|
scan.append((r.BaseAddress, r.RegionSize))
|
|
|
|
# Find outer-object addresses
|
|
outers = []
|
|
for base, size in scan:
|
|
try:
|
|
reader.move(base); buf = reader.read(size)
|
|
except Exception:
|
|
continue
|
|
if not buf: continue
|
|
end = (len(buf) // 4) * 4
|
|
for off in range(0, end - 4, 4):
|
|
if struct.unpack_from("<I", buf, off)[0] != GM_NOTICE_VT: continue
|
|
outer = (base + off) - GM_NOTICE_OFFSET
|
|
# Read outer vt
|
|
rel = off - GM_NOTICE_OFFSET
|
|
if rel < 0:
|
|
# outer is in previous region; skip
|
|
continue
|
|
outer_vt = struct.unpack_from("<I", buf, rel)[0]
|
|
if outer_vt == 0x007c0498: # primary gm*UI base vt
|
|
outers.append(outer)
|
|
|
|
outers.sort()
|
|
print(f"gm*UI outers (vt 0x007c0498): {len(outers)}")
|
|
|
|
# Compute deltas between consecutive outers
|
|
deltas = Counter()
|
|
for i in range(1, len(outers)):
|
|
d = outers[i] - outers[i-1]
|
|
if d < 0x4000: # only intra-allocation neighbors
|
|
deltas[d] += 1
|
|
|
|
print("top inter-instance deltas (bytes between adjacent outers in same region):")
|
|
for d, n in deltas.most_common(15):
|
|
print(f" 0x{d:04x} ({d:>6}) x{n}")
|
|
|
|
# Also probe MEM_PRIVATE region sizes that *contain* gm*UI outers
|
|
sizes = Counter()
|
|
for o in outers:
|
|
for base, size in scan:
|
|
if base <= o < base + size:
|
|
sizes[size] += 1
|
|
break
|
|
print()
|
|
print("region sizes containing gm*UI outers:")
|
|
for s, n in sizes.most_common(15):
|
|
print(f" size={s:>9} ({s/1024:>6.1f}KB) x{n}")
|