Crash in quakeview

[jbush001]

This appears to be a new issue

1. Start quakeview in emulator
2. Hold up arrow
3. After 5 frames, it will crash:

Memory access out of range 81cfbe80 (MMU not enabled)
Thread 2 registers
 s0 00000e00  s1 00000e00  s2 001f6180  s3 0000010c  s4 0177f1c0  s5 0000ffff  s6 00000400  s7 00000001 
 s8 0000ffff  s9 01cfbe80 s10 00000148 s11 ffffff98 s12 00000501 s13 fffffe9b s14 000001e0 s15 fffffb37 
s16 00000001 s17 0000000e s18 fffffff9 s19 00000d40 s20 00000d00 s21 00000dc0 s22 00000d80 s23 00000000 
s24 001f6380 s25 00500c30 s26 001f6480 s27 005000b0 s28 00016004 s29 00000000 s30 001f6080 s31 00004730 
pc 0000add0 flags: S

 v0 7fffffff7fffffff7fffffff7fffffff4323b6e1432424984324924e4325000543220000432236dc43226db74322a49343216db3432192474321b6d84321db6b
 v1 80000000800000008000000080000000000000a3000000a4000000a4000000a5000000a2000000a2000000a2000000a2000000a1000000a1000000a1000000a1
 v2 7fffffff7fffffff7fffffff7fffffff43b7000b43b7000b43b7000b43b7000b43cf000143cf000143cf000143cf000143d6fffd43d6fffd43d6fffd43d6fffd
 v3 800000008000000080000000800000000000016e0000016e0000016e0000016e0000019e0000019e0000019e0000019e000001ad000001ad000001ad000001ad
 v4 81cfbe8081cfbe8081cfbe8081cfbe8001d5772301d5772401d5772401d5772501d6372201d6372201d6372201d6372201d6732101d6732101d6732101d67321
 v5 81cfbe8081cfbe8081cfbe8081cfbe8001d5772001d5772401d5772401d5772401d6372001d6372001d6372001d6372001d6732001d6732001d6732001d67320
 v6 00000400000004000000040000000400000004000000040000000400000004000000040000000400000004000000040000000400000004000000040000000400
 v7 7fffffff7fffffff7fffffff7fffffff3ebd82913ebcc67c3ebc0a693ebb4e703ec072683df09e883de0aa9c3de06dc53e9b7d023ebb4d983e66f5933e970630
 v8 7fffffff7fffffff7fffffff7fffffff3c0173343c0173343c0173343c0173343c0026673a16c3c43a16c3c439dd1f203bff4cce3bff4cce3bff4cce3bff4cce
 v9 3b8080813b8080813b8080813b8080813b8080813b8080813b8080813b8080813b8080810000000000000000000000003b8080813b8080813b8080813b808081
v10 7fffffff7fffffff7fffffff7fffffff382272733822727338227273382272733820d0d100000000000000000000000038203031382030313820303138203031
v11 7fffffff7fffffff7fffffff7fffffff3e9efa933e9d7b143e9bfb963e9a7c4f3ea4f91c3cd8be933da1b6303cf266773e240b973e9a7d103c80f3f53e210d08
v12 01cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe8001cfbe80
v13 7fffffff7fffffff7fffffff7fffffff3b8cdf403b8cdf403b8cdf403b8cdf403b8b75163a87b0313a87b0313a672c2d3b8ae9ca3b8ae9ca3b8ae9ca3b8ae9ca
v14 7fffffff7fffffff7fffffff7fffffff3f4ac7013f4ac7013f4ac7013f4ac7013f4acc343d6e95e33d6e95e33db6ea613f4ace343f4ace343f4ace343f4ace34
v15 7fffffff7fffffff7fffffff7fffffff3dfe77383e0f230f3e1f0a833e2ef1f63d7e7dbf3e1b14a03e1b14a03e1b14a03e2ef82c3e2ef82c3e3ee0313e3ee031
v16 3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3d70f0f23d70f0f23db8b8b93f4cccce3f4cccce3f4cccce3f4cccce
v17 3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3f4cccce3d30b0b13d30b0b13df8f8fa3f4cccce3f4cccce3f4cccce3f4cccce
v18 000000000000000000000000000000000005b8000005b8000005b8000005b800000678000006780000067800000678000006b4000006b4000006b4000006b400
v19 80000001800000018000000180000001000000a4000000a5000000a5000000a6000000a3000000a3000000a3000000a3000000a2000000a2000000a2000000a2
v20 00000001000000010000000100000001000000010000000100000001000000010000000100000001000000010000000100000001000000010000000100000001
v21 3f0484853f0484853f0484853f0484853e0080813e1090913e20a0a13e30b0b13d8080813df8f8fa3df8f8fa3df8f8fa3e30b0b13e30b0b13e40c0c23e40c0c2
v22 37383736373837363738373637383736373837363738373637383736373837363738373600171f2700171f27000f1b273b3b3a36373837363738373637383736
v23 3c0080813c0080813c0080813c0080813edadadc3edadadc3edadadc3edadadc3edadadc3dd8d8da3dd8d8da3df8f8fa3edadadc3edadadc3edadadc3edadadc
v24 3c8080813c8080813c8080813c8080813ededee03ededee03ededee03ededee03ededee03db8b8b93db8b8b93df8f8fa3ededee03ededee03ededee03ededee0
v25 81cfbe8081cfbe8081cfbe8081cfbe8001cfbf2301cfbf2401cfbf2401cfbf2501cfbf2201cfbf2201cfbf2201cfbf2201cfbf2101cfbf2101cfbf2101cfbf21
v26 800000018000000180000001800000010000016f0000016f0000016f0000016f0000019f0000019f0000019f0000019f000001ae000001ae000001ae000001ae
v27 00000400000004000000040000000400000004000000040000000400000004000000040000000400000004000000040000000400000004000000040000000400
v28 00000000000000000000000000000000000000180000001800000018000000180000003000000030000000300000003000000048000000480000004800000048
v29 fffffffdfffffffeffffffff00000000ffffffe4ffffffe5ffffffe6ffffffe7ffffffcbffffffccffffffcdffffffceffffffb2ffffffb3ffffffb4ffffffb5
v30 fffffffdfffffffcfffffffbfffffffafffffffefffffffdfffffffcfffffffbfffffffffffffffefffffffdfffffffc00000000fffffffffffffffefffffffd
v31 0000001800000018000000180000001800000078000000780000007800000078000000d8000000d8000000d8000000d800000138000001380000013800000138

The problem happens here, in Texture::readPixels:

add0:	c5 02 00 bc 	load_gath_mask v22, s0, (v5)

[jbush001]

The issue is that the first vector elements of the u and v values passed into Texture::readPixels are NaN:

v0 7fffffff7fffffff7fffffff7fffffff4323b6e1432424984324924e4325000543220000432236dc43226db74322a49343216db3432192474321b6d84321db6b

The float->integer conversion changes these to 0x80000000, which creates an invalid memory address. I verified this by adding checking code:

    if (tx[0] < 0 || tx[0] > 1024) {
        printf("tx[0] %08x u[0] %x uRaster[0] %x\n", tx[0],
            asInt(u[0]), asInt(uRaster[0]));
    }

tx[0] 80000000 u[0] 7fffffff uRaster[0] 7fffffff