[function] preset interpolation is crashing Max 9.0.6.0

Miscbugs/issues
Baek Santarek's icon

Baek Santarek

Wildly interpolating 4 presets of [function] object with nodes object often crashes Max.

See the event log below.

Faulting application name: Max.exe, version: 9.0.6.0, time stamp: 0x681d12e6

Faulting module name: function.mxe64, version: 9.0.6.0, time stamp: 0x681d138c

Exception code: 0xc0000005

Fault offset: 0x0000000000001965

Faulting process id: 0x5038

Faulting application start time: 0x01dbc7d72d78ceed

Faulting application path: C:\Program Files\Cycling '74\Max 9\Max.exe

Faulting module path: C:\Program Files\Cycling '74\Max 9\resources\externals\max\function.mxe64

Report Id: dcc55faf-c50d-4a51-9ce1-22bad2f8a250

Faulting package full name:

Faulting package-relative application ID:

Baek Santarek's icon

Baek Santarek

I have also tried to upload the dump file but for some unknown reason the forum does not allow me to. The upload dialog simply disappears and that's it.

I have also tried to zip it but then the error "Editor.uploads.unaccepableFileType" pops up.

Baek Santarek's icon

Baek Santarek

This is the dump file content after analysis in WinDbg:

*                                                                             *
                        Exception Analysis                                   
*                                                                             *
*******************************************************************************
*** WARNING: Unable to verify checksum for Max.exe
*** WARNING: Unable to verify checksum for MaxAudio.dll
*** WARNING: Unable to verify checksum for ad_mme.mxe64
KEY_VALUES_STRING: 1
    Key  : AV.Dereference
    Value: NullClassPtr
    Key  : AV.Fault
    Value: Read
    Key  : Analysis.CPU.mSec
    Value: 843
    Key  : Analysis.Elapsed.mSec
    Value: 25435
    Key  : Analysis.IO.Other.Mb
    Value: 26
    Key  : Analysis.IO.Read.Mb
    Value: 0
    Key  : Analysis.IO.Write.Mb
    Value: 52
    Key  : Analysis.Init.CPU.mSec
    Value: 1108
    Key  : Analysis.Init.Elapsed.mSec
    Value: 45113
    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 110
    Key  : Failure.Bucket
    Value: NULL_CLASS_PTR_READ_c0000005_function.mxe64!Unknown
    Key  : Failure.Hash
    Value: {a8c56d61-e233-4538-a801-d42461f5ea04}
    Key  : Timeline.Process.Start.DeltaSec
    Value: 153
    Key  : WER.OS.Branch
    Value: vb_release
    Key  : WER.OS.Version
    Value: 10.0.19041.1
    Key  : WER.Process.Version
    Value: 9.0.6.0
FILE_IN_CAB:  Max-2025-05-18_11-30-46-28065a4add0.dmp
NTGLOBALFLAG:  0
CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000000000000003 rcx=00000000ffffffff
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000002
rip=000000002d521965 rsp=00000000062af200 rbp=000000000710dda0
 r8=0000000000000000  r9=00000000379dafb8 r10=00000000062af010
r11=00000000062af040 r12=000000000000000c r13=0000000000000024
r14=000000002c33ca90 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
function!ext_main+0x855:
00000000`2d521965 f20f104828      movsd   xmm1,mmword ptr [rax+28h] ds:00000000`00000028=????????????????
Resetting default scope
EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 000000002d521965 (function!ext_main+0x0000000000000855)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000028
Attempt to read from address 0000000000000028
PROCESS_NAME:  Max.exe
READ_ADDRESS:  0000000000000028 
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
EXCEPTION_CODE_STR:  c0000005
EXCEPTION_PARAMETER1:  0000000000000000
EXCEPTION_PARAMETER2:  0000000000000028
STACK_TEXT:  
00000000`062af200 00000001`404aa3a0     : 00000000`00000001 00000000`00000000 00000000`38126700 00000000`00000001 : function!ext_main+0x855
00000000`062af290 00000001`404aa3a0     : 00000000`38128b60 00000000`00000000 00000000`38b42080 00000000`00000000 : Max!readtohandle+0x1030
00000000`062af300 00007ff8`0f3e1d43     : 00000000`3b36d920 00000000`00000095 00000000`00000001 00000000`00000001 : Max!readtohandle+0x1030
00000000`062af370 00000001`404b1be1     : 00000000`2cfae3f0 00000000`00000095 00000000`00000001 00000000`00000001 : MaxAudio!schedvalue_set+0x93
00000000`062af3b0 00007ff8`0f3df9fa     : 00000000`00000001 00000000`00000010 00000000`3aae3d70 00000000`00000000 : Max!scheduler_run+0x1a1
00000000`062af410 00007ff8`0f3debbb     : 00000000`2cfae3f0 00000000`00000000 00000000`3aae3d70 00000000`00000000 : MaxAudio!plugrunner_serviceclocks+0x2a
00000000`062af480 00007ff8`0f3d5ea6     : 00000000`2cfae3f0 00000000`00000001 4102a6aa`b768a000 00000000`3b6c2ca0 : MaxAudio!plugrunner_process+0x39b
00000000`062af510 00007ff8`0f3d08c7     : 00000000`3b6c2ca0 00000000`00000000 00000000`00000010 00000000`00000010 : MaxAudio!parambuffer_write+0xf96
00000000`062af5c0 00000001`40475aa2     : 407f4000`00000000 00000000`00000000 408f4000`00000000 00000001`4052f333 : MaxAudio!midibuffer_write+0x7f37
00000000`062af600 00007ff8`0f3d0d43     : 00000000`071bd480 00000000`187fe900 00000000`00000010 00000000`071bd480 : Max!linklist_funall_break+0xe2
00000000`062af650 00007ff8`0f3e7bb5     : 00000000`00009f00 00000000`00000010 00000000`00000660 00000000`187fe900 : MaxAudio!midibuffer_write+0x83b3
00000000`062af740 00000000`1a861a4b     : 00000000`00000000 00000000`00000001 00000000`17d38ee0 00000000`0045b800 : MaxAudio!timeevent_todictionary+0x5815
00000000`062af7a0 00007ff8`2d331bb2     : 00000000`3b3e39a0 00000000`3b3e39a0 00000000`00000000 00000000`00000000 : ad_mme+0x1a4b
00000000`062aff00 00007ff8`2e2d7374     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ucrtbase!thread_start<unsigned int (__cdecl*)(void *),1>+0x42
00000000`062aff30 00007ff8`2f69cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x14
00000000`062aff60 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
SYMBOL_NAME:  function+855
MODULE_NAME: function
IMAGE_NAME:  function.mxe64
STACK_COMMAND:  ~46s; .ecxr ; kb
FAILURE_BUCKET_ID:  NULL_CLASS_PTR_READ_c0000005_function.mxe64!Unknown
OS_VERSION:  10.0.19041.1
BUILDLAB_STR:  vb_release
OSPLATFORM_TYPE:  x64
OSNAME:  Windows 10
IMAGE_VERSION:  9.0.6.0
FAILURE_ID_HASH:  {a8c56d61-e233-4538-a801-d42461f5ea04}
Followup:     MachineOwner
---------
TFL's icon

TFL

If you have a small patch to consistently reproduce the crash it's worth submitting a ticket with it + the crash log.

Baek Santarek's icon

Baek Santarek

I can reproduce it semi-randomly with my patch. I don't have strictly deterministic reproduction steps. It's tricky. You have to basically move XY pad randomly to interpolate presets in a pattrstorage for some time until the function object cannot handle it anymore and crashes Max.

I have tried to simulate the random XY pad movement programmatically (seeded random) to find a deterministic scenario but with it didn't crash yet. I have been only able to reproduce it manually so far.

I think the dump log should tell the devs more. Especially this line:

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.
Baek Santarek's icon

Baek Santarek

OK so I have a suspect now. Not confirmed yet but I think frequency of data output from certain GUI objects can overload the function when modulating the interpolation of pattrstorage presets?

I have placed timer directly after the nodes object and it seems, at least with SIAI, it is possible to send values so that the timer reports 0. samples from time to time??? Seems nonsensical but that's what I read in the console. The number object does it too.

When I made sure there is at least 1 ms delay between the events with speedlim, I wasn't able to reproduce the crash anymore so I think there might be something to it even in case the timer were indeed nonsensical.

But I think the function should not crash anyway. There should be a safety check for this because it's very easy to crash it with live user input.

Ben Bracken's icon

Ben Bracken

As @TFL mentions, a reduced patch with repro steps would be incredibly helpful.