fatal CRASH - CAMPAIGN: CHALLENGE_9 3

[Ba-Tech15]

Prerequisites

• I have searched for similar issues and confirmed this is not a duplicate

Game Version

• Command & Conquer Generals
• Command & Conquer Generals: Zero Hour
• Other (please specify below)

Bug Description

using release weekly-2026-01-02 game keep crashing when loading Mission Start - Missing:'campaign: challenge_9' 3

Reproduction Steps

1. start the game
2. load: Mission Start - Missing:'campaign: challenge_9' 3
   setting that always crash:
   resolution don't matter
   detail don't matter

Additional Context

No response

[xezon]

What is CHALLENGE_9 3 ?

[Gchipunov]

Probably scripting error

[JohnsterID]

Time to change the crash message text? Tell the user to submit the minidump?

GeneralsGameCode/Core/GameEngine/Source/Common/System/Debug.cpp

Lines 812 to 820 in 13de427

	::MessageBox(NULL, buff, "Technical Difficulties...", MB_OK|MB_SYSTEMMODAL|MB_ICONERROR);
	#else
	// crash error messaged changed 3/6/03 BGC
	// ::MessageBox(NULL, "Sorry, a serious error occurred.", "Technical Difficulties...", MB_OK|MB_TASKMODAL|MB_ICONERROR);
	// ::MessageBox(NULL, "You have encountered a serious error. Serious errors can be caused by many things including viruses, overheated hardware and hardware that does not meet the minimum specifications for the game. Please visit the forums at www.generals.ea.com for suggested courses of action or consult your manual for Technical Support contact information.", "Technical Difficulties...", MB_OK|MB_TASKMODAL|MB_ICONERROR);
	// crash error message changed again 8/22/03 M Lorenzen... made this message box modal to the system so it will appear on top of any task-modal windows, splash-screen, etc.
	::MessageBox(NULL, "You have encountered a serious error. Serious errors can be caused by many things including viruses, overheated hardware and hardware that does not meet the minimum specifications for the game. Please visit the forums at www.generals.ea.com for suggested courses of action or consult your manual for Technical Support contact information.",
	"Technical Difficulties...",

[Ba-Tech15]

this is the challenge campaign. mission 3.

[slurmlord]

If you are able to attach the corresponding CrashMZ file (the CrashFZ files are too big for GitHub), it would be a lot easier to pinpoint in which area the crash occurs.
Alternatively you can try to follow the wiki for crashdumps and find the source of the crash yourself if you want.

[Ba-Tech15]

CrashMZ-20260104-224010-5e8f1b8-pid4292.dmp

CrashMZ-20260102-192317-5e8f1b8-pid15940.dmp

as you can see in the picture it happen while the intro of the mission is going near end and some graphic up normality happen and crash

[Ba-Tech15]

issue no with the game some. work after reinstall with new gamedata.ini

[slurmlord]

Looks like both dumps are at the same place for the same reason; Access violation when writing to the vertex buffer for a tree.

Exception

0:000> .cxr 0019f11c
eax=448fb9a3 ebx=0000002d ecx=14ef0030 edx=06772854 esi=14ecd180 edi=193a0010
eip=0074954a esp=0019f584 ebp=14ef0060 iopl=0         nv up ei pl nz ac po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210212
generalszh!W3DTreeBuffer::updateVertexBuffer+0x28a:
0074954a 894704          mov     dword ptr [edi+4],eax ds:002b:193a0014=????????
0:000> .exr 0019f0cc
ExceptionAddress: 0074954a (generalszh!W3DTreeBuffer::updateVertexBuffer+0x0000028a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000001
   Parameter[1]: 193a0014
Attempt to write to address 193a0014

Stack trace

00 0019f5e8 0074af34     generalszh!W3DTreeBuffer::updateVertexBuffer+0x28a [D:\a\GeneralsGameCode\GeneralsGameCode\Core\GameEngineDevice\Source\W3DDevice\GameClient\W3DTreeBuffer.cpp @ 1053] 
01 0019f7b8 007241ee     generalszh!W3DTreeBuffer::drawTrees+0x464 [D:\a\GeneralsGameCode\GeneralsGameCode\Core\GameEngineDevice\Source\W3DDevice\GameClient\W3DTreeBuffer.cpp @ 1704] 
02 0019f898 00766dba     generalszh!DoTrees+0x2fe [D:\a\GeneralsGameCode\GeneralsGameCode\Core\GameEngineDevice\Source\W3DDevice\GameClient\BaseHeightMap.cpp @ 122] 
03 0019f8a8 00767487     generalszh!RTS3DScene::Flush+0x4a [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\W3DDevice\GameClient\W3DScene.cpp @ 873] 
04 0019f8e8 007c3077     generalszh!RTS3DScene::Render+0x137 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\W3DDevice\GameClient\W3DScene.cpp @ 988] 
05 0019fa38 0076887b     generalszh!WW3D::Render+0x317 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\Libraries\Source\WWVegas\WW3D2\ww3d.cpp @ 977] 
06 0019fa5c 00768828     generalszh!RTS3DScene::draw+0x3b [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\W3DDevice\GameClient\W3DScene.cpp @ 1763] 
07 0019fa64 0077d5b8     generalszh!RTS3DScene::doRender+0x18 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\W3DDevice\GameClient\W3DScene.cpp @ 1748] 
08 0019fc40 004218d2     generalszh!W3DView::draw+0xf8 [D:\a\GeneralsGameCode\GeneralsGameCode\Core\GameEngineDevice\Source\W3DDevice\GameClient\W3DView.cpp @ 1582] 
09 0019fc48 0077494e     generalszh!Display::drawViews+0x12 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngine\Source\GameClient\Display.cpp @ 115] 
0a 0019fca0 004abb54     generalszh!W3DDisplay::draw+0x3fe [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\W3DDevice\GameClient\W3DDisplay.cpp @ 1866] 
0b 0019fd00 0040fa0b     generalszh!GameClient::update+0x514 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngine\Source\GameClient\GameClient.cpp @ 764] 
0c 0019fd14 00715ed9     generalszh!GameEngine::update+0x2b [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngine\Source\Common\GameEngine.cpp @ 900] 
0d 0019fd4c 00415650     generalszh!Win32GameEngine::update+0x9 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngineDevice\Source\Win32Device\Common\Win32GameEngine.cpp @ 93] 
0e 0019fd6c 00401b50     generalszh!GameMain+0xa0 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\GameEngine\Source\Common\GameMain.cpp @ 59] 
0f 0019fed8 008a4a0c     generalszh!WinMain+0x3b0 [D:\a\GeneralsGameCode\GeneralsGameCode\GeneralsMD\Code\Main\WinMain.cpp @ 925] 
10 0019ff74 76225d49     generalszh!WinMainCRTStartup+0x134
11 0019ff84 77e7d5db     kernel32!BaseThreadInitThunk+0x19
12 0019ffdc 77e7d561     ntdll!__RtlUserThreadStart+0x2b
13 0019ffec 00000000     ntdll!_RtlUserThreadStart+0x1b

Locals at the crash stack frame

0:000> dv /t /v
@ecx              class W3DTreeBuffer * this = 0x14ef0030
14ef000c          int bNdx = 0n0
14ef0034          class VertexBufferClass::WriteLockClass lockVtxBuffer = class VertexBufferClass::WriteLockClass
14ef0024          int curTree = 0n0
14ef002c          struct VertexFormatXYZNDUV1 * vb = 0x448fc635
14ef0014          float theCos = 0
14ef0048          class Vector3 loc = class Vector3
14ef001c          float theSin = 0
14ef0008          float scale = 0
14ef003c          class Vector3 vLoc = class Vector3
14ef0010          float y = 0
14ef0018          float x = 0

The strange part (to me) is the address that was attempted written to is 0x193a0014, which is

curVb->x = vLoc.X;

where curVb is

curVb = vb+startVertex;

and vb is 0x448fc635. To me this indicates an overflow via startVertex (where the offset from vb is effectively 0xd4aa39db)? But as there was visible graphical corruption in the provided image, maybe all bets are off at that point? Tagging @xezon as he's been doing some work in this area before.