[Crash] Access violation in nvnTextureBuilderSetSwizzle when opening the ocarina note sheet (RTX 5070 Ti) #500

Closed

opened 2026-11-08 06:44:05 +00:00 by Bronnzy · 3 comments

Bronnzy commented

2026-11-08 06:44:05 +00:00

(Migrated from github.com)

Builder version

current main (46ea554), built from source

How you built

From source (pipeline as in #384)

Game files given to it

A .nup (build e0f3ccfa)

The error

Freeze, then crash, on opening the ocarina note sheet. In Hyrule Field, after taking the ocarina: the first open of the note sheet froze the picture (~9 s at ~14 fps in the log's present intervals) — the audio kept running. Opening it a second time crashed the game outright.

Windows WER signature:

APPCRASH
P4: hookshot.exe
P7: c0000005            (access violation, read)
P8: 000000001954081d    (RVA)

Resolved against that build's hookshot.map: the RVA lands inside n_nvnTextureBuilderSetSwizzle, +0x2d into it — i.e. TB(P(0))->d.swizzle_r = ... dereferenced a null or freed texture-builder pointer (host/nvn_native.c, the NV(nvnTextureBuilderSetSwizzle) handler; none of the nvnTextureBuilder* handlers null-check P(0)).

Context from the same session's log: the freeze window shows new texture/program churn (the sheet UI's first build), then the second open hit the stale builder. Session before the crash: 108,240 presents, mean 54.7 fps, 0 shader failures, no other crash — see #386 for the session's full picture.

A null guard in the nvnTextureBuilder* handlers (early return when P(0) is null, like a console would silently tolerate) would at least turn this crash into a visible glitch. Reproduction: take the ocarina, open the note sheet, close it, open it again.

Visual Studio or Build Tools version, and Windows SDK version

MSVC 14.44, SDK 10.0.26100

Operating system and free space on the output drive

Windows 11, ~60 GB free

Confirmations

On the newest release, and it still fails there.
Open issues searched before filing.
No game files or anything built from them is attached.

### Builder version current `main` (46ea554), built from source ### How you built From source (pipeline as in #384) ### Game files given to it A .nup (build `e0f3ccfa`) ### The error **Freeze, then crash, on opening the ocarina note sheet.** In Hyrule Field, after taking the ocarina: the first open of the note sheet froze the picture (~9 s at ~14 fps in the log's present intervals) — the audio kept running. Opening it a second time crashed the game outright. Windows WER signature: ``` APPCRASH P4: hookshot.exe P7: c0000005 (access violation, read) P8: 000000001954081d (RVA) ``` Resolved against that build's `hookshot.map`: the RVA lands inside **`n_nvnTextureBuilderSetSwizzle`**, +0x2d into it — i.e. `TB(P(0))->d.swizzle_r = ...` dereferenced a null or freed texture-builder pointer (`host/nvn_native.c`, the `NV(nvnTextureBuilderSetSwizzle)` handler; none of the `nvnTextureBuilder*` handlers null-check `P(0)`). Context from the same session's log: the freeze window shows new texture/program churn (the sheet UI's first build), then the second open hit the stale builder. Session before the crash: 108,240 presents, mean 54.7 fps, 0 shader failures, no other crash — see #386 for the session's full picture. A null guard in the `nvnTextureBuilder*` handlers (early return when `P(0)` is null, like a console would silently tolerate) would at least turn this crash into a visible glitch. Reproduction: take the ocarina, open the note sheet, close it, open it again. ### Visual Studio or Build Tools version, and Windows SDK version MSVC 14.44, SDK 10.0.26100 ### Operating system and free space on the output drive Windows 11, ~60 GB free ### Confirmations - On the newest release, and it still fails there. - Open issues searched before filing. - No game files or anything built from them is attached.

Bronnzy commented

2026-11-08 07:02:12 +00:00

(Migrated from github.com)

P7: c0000005
P8: 000000001954081d    (same RVA: n_nvnTextureBuilderSetSwizzle +0x2d)

So it is not specific to the ocarina sheet — it reproduces in combat too, as a freeze-then-crash-on-second-freeze pattern, with the null/freed texture-builder pointer being dereferenced in nvnTextureBuilderSetSwizzle both times. The freeze-then-crash cadence suggests the game recovers the first stale-builder state and the second one is fatal.

Near the crash, the log shows mesh-program work for the flying enemies (mesh b46dc62c84b9b85e, 32 threads, storage buffers in c0) and repeated upload over a drawn image warnings (textures #242 1536x864 and #1704 384x216 the GPU wrote and the game uploaded over) — possibly related to how the builders for those combat textures are recycled.

Second reproduction, different context: in combat against flying enemies in Hyrule Field, the game froze once (picture stalled, audio continued), and the second freeze crashed with the **exact same signature**: ``` P7: c0000005 P8: 000000001954081d (same RVA: n_nvnTextureBuilderSetSwizzle +0x2d) ``` So it is not specific to the ocarina sheet — it reproduces in combat too, as a freeze-then-crash-on-second-freeze pattern, with the null/freed texture-builder pointer being dereferenced in `nvnTextureBuilderSetSwizzle` both times. The freeze-then-crash cadence suggests the game recovers the first stale-builder state and the second one is fatal. Near the crash, the log shows mesh-program work for the flying enemies (`mesh b46dc62c84b9b85e`, 32 threads, storage buffers in c0) and repeated `upload over a drawn image` warnings (textures #242 1536x864 and #1704 384x216 the GPU wrote and the game uploaded over) — possibly related to how the builders for those combat textures are recycled.

nicholasgower commented

2026-11-08 09:27:46 +00:00

(Migrated from github.com)

0c511fd is in main: a texture builder with no address now goes to a zeroed scratch builder, so nvnTextureBuilderSetSwizzle no longer reads A64_MEM + 0x5c, and the first four occurrences log nvn: a texture builder of no address (lr ...).

I added a game-free regression test that builds the real setter from host/nvn_native.c and calls it with a null builder: PR #540. Please retest on a build with that commit, especially the combat reproduction from your second comment, and attach hookshot_log.txt if it still crashes. The last nvn: a texture builder line is the one I need.

`0c511fd` is in `main`: a texture builder with no address now goes to a zeroed scratch builder, so `nvnTextureBuilderSetSwizzle` no longer reads `A64_MEM + 0x5c`, and the first four occurrences log `nvn: a texture builder of no address (lr ...)`. I added a game-free regression test that builds the real setter from `host/nvn_native.c` and calls it with a null builder: PR #540. Please retest on a build with that commit, especially the combat reproduction from your second comment, and attach `hookshot_log.txt` if it still crashes. The last `nvn: a texture builder` line is the one I need.

NotRexed commented

2026-11-08 09:56:23 +00:00

(Migrated from github.com)

Fixed in release faster-fps: a null texture builder now gets a scratch one, so the ocarina note sheet no longer crashes. Please update from https://github.com/NotRexed/Hookshot/releases/latest.