DOS ain't dead - DirectDrawSurface::Blt in MPlayer

sherpya

07.04.2013, 08:49

DirectDrawSurface::Blt in MPlayer (Developers)

I have a problem in emulated ddraw.dll, I'm unable to understand why but here some info for developers:

It happens by using directx video output and requesting full screen draw with -fs.
It doesn't switch resolution but instead it blits stretched.

I have a video file with resolution 640x480, the screen set in .ini is 1024x768x16

mplayer calls DirectDrawSurface::Blt()

HRESULT Blt(
LPRECT lpDestRect,
LPDIRECTDRAWSURFACE lpDDSrcSurface,
LPRECT lpSrcRect,
DWORD dwFlags,
LPDDBLTFX lpDDBltFx
);

g_lpddsPrimary->lpVtbl->Blt(g_lpddsPrimary, &rd, g_lpddsBack, NULL, DDBLT_WAIT, &ddbltfx);

rd is 0,0,1024,768
g_lpddsBack = @02176030
ddbltfx is a just allocated struct but the flag is ignored

with debug enabled I get this trace (values in hex)
DirectDrawSurface::Blt, Dst=2175FBC pSF=28D0000 Rect=0 0 400 300 bpp=10 pitch=800

I've added this to debug the fill function, that is in a loop, the Blt code is in DDDRAW\SURFACE.ASM
at line 663 in version 2.17 (call lpfnCopyProc) that is assigned to proc16to16_11 (if you set bpp=16 in ini)

proc16to16_11: shr ecx, 1 ; rep movsd - esi:4031000 edi:28D0000
...
proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6100 edi:29BE800
proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6600 edi:29BF000
proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6B00 edi:29BF800
*** exception C0000005 EIP=2864809 EAX=800 EBX=2175FBC ECX=C0 EDX=500
ESI=40C7000 EDI=29BFD00 FS=E7 BaseFS=125000 FS:[0]=364304 arg[1]=40C7000

---
in hxstderr.log:

dkrnl32: exception C0000005, flags=0 occured at BF:2864809
ax=800 bx=2175FBC cx=C0 dx=500
si=40C7000 di=29BFD00 bp=325CD8 sp=325CAC
exception caused by access to memory address 40C7000
ip = Module 'ddraw.dll'+3809
[eip] = F3 A5 C3 60 68 F9 8C 86 02 FF 15 A8
[esp] = 00000000 00127100 00325AAC 00325AAC 00325A8C 0033FA86
dkrnl32: fatal exit!

Any help is greatly appreciated
Thanks

Japheth

Germany (South),
09.04.2013, 20:10

@ sherpya

DirectDrawSurface::Blt in MPlayer

Post reply

> I have a problem in emulated ddraw.dll, I'm unable to understand why but
> here some info for developers:
>
> It happens by using directx video output and requesting full screen draw
> with -fs.
> It doesn't switch resolution but instead it blits stretched.
>
> I have a video file with resolution 640x480, the screen set in .ini is
> 1024x768x16
>
> mplayer calls DirectDrawSurface::Blt()
>
> HRESULT Blt(
> LPRECT lpDestRect,
> LPDIRECTDRAWSURFACE lpDDSrcSurface,
> LPRECT lpSrcRect,
> DWORD dwFlags,
> LPDDBLTFX lpDDBltFx
> );
>
> g_lpddsPrimary->lpVtbl->Blt(g_lpddsPrimary, &rd, g_lpddsBack, NULL,
> DDBLT_WAIT, &ddbltfx);
>
> rd is 0,0,1024,768
> g_lpddsBack = @02176030
> ddbltfx is a just allocated struct but the flag is ignored
>
> with debug enabled I get this trace (values in hex)
> DirectDrawSurface::Blt, Dst=2175FBC pSF=28D0000 Rect=0 0 400 300 bpp=10
> pitch=800
>
> I've added this to debug the fill function, that is in a loop, the Blt code
> is in DDDRAW\SURFACE.ASM
> at line 663 in version 2.17 (call lpfnCopyProc) that is assigned to
> proc16to16_11 (if you set bpp=16 in ini)
>
> proc16to16_11: shr ecx, 1 ; rep movsd - esi:4031000 edi:28D0000
> ...
> proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6100 edi:29BE800
> proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6600 edi:29BF000
> proc16to16_11: shr ecx, 1 ; rep movsd - esi:40C6B00 edi:29BF800
> *** exception C0000005 EIP=2864809 EAX=800 EBX=2175FBC ECX=C0 EDX=500
> ESI=40C7000 EDI=29BFD00 FS=E7 BaseFS=125000 FS:[0]=364304 arg[1]=40C7000
>
> ---
> in hxstderr.log:
>
> dkrnl32: exception C0000005, flags=0 occured at BF:2864809
> ax=800 bx=2175FBC cx=C0 dx=500
> si=40C7000 di=29BFD00 bp=325CD8 sp=325CAC
> exception caused by access to memory address 40C7000
> ip = Module 'ddraw.dll'+3809
> [eip] = F3 A5 C3 60 68 F9 8C 86 02 FF 15 A8
> [esp] = 00000000 00127100 00325AAC 00325AAC 00325A8C 0033FA86
> dkrnl32: fatal exit!
>
> Any help is greatly appreciated
> Thanks

The reason for the crash is simple: access to address 40c7000 caused a page fault. From your debug code register ESI holds this address, which is the source of a memory block copy.

A vague guess is that the function calculates the height incorrectly.

---
MS-DOS forever!

sherpya 11.04.2013, 13:44 @ Japheth	DirectDrawSurface::Blt in MPlayer Post reply
	> > The reason for the crash is simple: access to address 40c7000 caused a page > fault. From your debug code register ESI holds this address, which is the > source of a memory block copy. > > A vague guess is that the function calculates the height incorrectly. it's strange the same code does work on win32 and on wine, I'll try to investigate

Japheth

Germany (South),
11.04.2013, 15:01

@ sherpya

DirectDrawSurface::Blt in MPlayer

Post reply

> it's strange the same code does work on win32 and on wine, I'll try to
> investigate

Well, I was trying to tell that there might be a bug in the HX IDirectDrawSurface::Blt function.

Without a test case I can't do much - perhaps propose a possible fix?

Add the code in the "if 1 ... endif"-block to function Blt in surface.asm:

mov edx, [ecx].RECT.bottom sub edx, [ecx].RECT.top cmp edx, dwHeight jnc @F mov dwHeight, edx @@: if 1 .else mov ecx,[esi].DDSF.dwWidth cmp ecx, dwWidth jnc @F mov dwWidth, ecx @@: mov edx,[esi].DDSF.dwHeight cmp edx, dwHeight jnc @F mov dwHeight, edx @@: endif .endif mov edx, [esi].DDSF.lPitch mov esi, [esi].DDSF.lpSurface

---
MS-DOS forever!

DOS386

10.04.2013, 11:47
(edited by DOS386, 10.04.2013, 16:07)

@ sherpya

DirectDrawSurface::Blt in MPlayer

Post reply

Sherpya wrote:

> I have a problem in emulated ddraw.dll, I'm unable to understand

Thanks for coming in here :-) and the other discussion ... I have the same BUG ... with "-fs" and for some movies even without ... just intended to post it. BTW, HX has a similar BUG in GDI too (reported long ago).

I haven't tested Sherpya's new files yet.

---
This is a LOGITECH mouse driver, but some software expect here
the following string:*** This is Copyright 1983 Microsoft ***