A new crash I am trying to diagnose

[Soulmancer]

Recently I have started experiencing a very frequent crash on a new game that occurs when leaving an indoor area.  I don't recall ever seeing a log like this before.  May be worth noting that I upgraded to 1.6.1130 then downgraded to 1.5.97 with best of both worlds.

https://pastebin.com/stuPBPBu

I have five more just like this within 5 hours of starting a new game, this log means nothing to me in the probable object/callstack.

Thx

 

[Mousetick]

Definitely something to do with the Papyrus script VM. Perhaps when saving the game, apparently. Do you have Autosave on Travel enabled?

Autosave on Travel enabled + crash when saving scripts in game save = crash when transitioning between indoor and outdoor. That's not to say Autosave on Travel is the cause or is faulty, it would merely be the trigger. Can you reliably perform manual saves?

[Soulmancer]

Foolishness on my part.  They were disabled at some point, not sure why but they had somehow become reenabled… I will turn em off and see if the ctd stops.  
 

thx

[Soulmancer]

Even with those all disabled, still getting this same crash very frequently.

Probable callstack
{
  [0]   0x7FF737662691     (SkyrimSE.exe+902691)          SkyrimScript::HandlePolicy::Func1_902560+131
  [1]   0x7FF737662CE4     (SkyrimSE.exe+902CE4)          SkyrimScript::HandlePolicy::Func9_902CB0+34
  [2]   0x7FF737F943C8     (SkyrimSE.exe+12343C8)         unk_1234360+68
  [3]   0x7FF737FBFF5D     (SkyrimSE.exe+125FF5D)         BSScript::IVMSaveLoadInterface::Func7_125F7C0+79D
  [4]   0x7FF73768E23F     (SkyrimSE.exe+92E23F)          SkyrimVM::unk_92DAE0+75F
  [5]   0x7FF8226BF640     (skse64_1_5_97.dll+F640)       
  [6]   0x5B      

 

the call stacks are always indentical...

Trainwreck gives me this log.  https://pastebin.com/dP0PpEAX

[Mousetick]

The trainwreck log shows the Papyrus VM crashed while loading the manual save Save121_2A78DFB9_1_596F6C6F68_ndcIdemdallOutpost_001354_20240124232126_5_1.ess.

[Soulmancer]

Yah, it seems to happen "mostly" when loading a saved game, after a current game is underway.  Seems ok when I start skyrim and load a save.   But if I say, die and reload then this crash seems quite common.  I enabled papyrus logging and it is.... busy.

But the last thing I am seeing in papyrus before it crashes is.  

" WARNING: Missing or zero refcount on (000#####) when releasing"

 

[Mousetick]

You're making it more difficult to help you by being too vague.

• "It is... busy": What exactly is busy, when and where? "The papyrus logging is busy" doesn't make any sense to me.
• 000#####: Is this what is literally written in the papyrus log, or is there a specific Form ID with actual numbers/letters?

Load up your entire load order in xEdit, look up the record with the given Form ID, check what overrides it and what uses it. The list of things that use the record can be seen on the 'Referenced By (n)' tab.

[Soulmancer]

Sorry.  Busy as in a ton of errors.  some errors once upon loading a save that prompt once then go quiet, and other errors spamming my papyrus throughout gameplay.   I am going to try to go through and clean this up by either looking into or removing the mods prompting errors.

Based on what I am seeing in these logs, it is far from good.

papyrus logs:

https://drive.google.com/file/d/152Ay58dUX7iuaQV7HKTnj3vGbFTUZwQx/view?usp=sharing

https://drive.google.com/file/d/13kTSQVjS2sar8xA1sp2NvdHWlOdFqk71/view?usp=sharing

 

[Mousetick]

Any luck finding the culprit yet, or any progress on the troubleshooting?

Googling "WARNING: Missing or zero refcount on when releasing" doesn't find much of anything, unfortunately. That's unfortunate.

These Papyrus warnings may be a red herring but they're quite unusual. And based on the small sample of logs you provided, they always precede the crash. There are other occurrences of the same warning (with different Form IDs) at various points throughout the logs, always immediately following a "Reverting game..." message as far as can tell. I think "Reverting game..." is printed when a previous save is reloaded.

Some of the Form IDs are prefixed by FF (e.g. FF00224A, FF002BC0). They are dynamically spawned references so we don't know what they are. Other Form IDs are vanilla references such as 0010ED38 or 0010ED36. I checked a few of them in xEdit, they're all references to ACTI base objects, such as ore or clay deposits, which have local scripts attached.

My wild guess is that something (could be a faulty script) is corrupting the VM's internal data structures during gameplay. When a game save is reloaded, the VM cleans up its memory by freeing up script instances. It finds unexpected garbage (Missing or zero refcount) but still goes ahead and accesses a bogus memory block, leading to the crash.

Have you tried opening a game save in ReSaver? It'd be interesting to see if the save file itself is healthy or not.

--

Unrelated to the crash issue: You have some scripts missing. Check the "Cannot open store for class" messages at the beginning of the Papyrus logs. For example, shovelbodymcmscript and ShovelBodyAliasScript are part of Shovels Bury Bodies and are necessary for it to function. It looks like you have that mod's plugin in your load order, but its scripts are not installed somehow, which would be a user error. Other scripts may be missing simply because a mod was shipped without them and is broken as a result, or because its plugin still references them although it doesn't really need/use them, which are mod author errors.

[RainingTacco]

Hello, any progress @Soulmancer? I encounter same crash. It happens ONLY during loading the game in already ongoing game.

https://pastebin.com/B2bmdDGy

Edited February 16 by RainingTacco

[MisterMorden]

I have also been getting a very similar ctd lately (SkyrimSE.exe+902691 and top 2 things in call stack are SkyrimScript::HandlePolicy::Func1_902560+131 & SkyrimScript::HandlePolicy::Func9_902CB0+34) however my logs have quite a few "possible relevant objects" listed but they are always different when the crash occurs.  I will post my crash logs here when I get home.

 

PS I noticed in the thread on this mod page someone else has this crash: https://www.nexusmods.com/skyrimspecialedition/mods/97155?tab=description

Edited February 17 by MisterMorden

[MisterMorden]

Mousetick, I noticed you were talking to someone in the posts section of Vanilla Script Micro Optimizations page about using 1.5.97 and the newest version of that mod being a problem...could this be related?

[Mousetick]

On 2/16/2024 at 1:19 PM, RainingTacco said:

I encounter same crash. It happens ONLY during loading the game in already ongoing game.

Yes, it's exactly the same crash and circumstances as Soulmancer. Your crash log shows the Papyrus VM crashed while loading Autosave3_28DD73E7_0_546F7276616C64_GraywinterWatch01_000654_20240216114521_10_1.ess.

Can you try to reproduce with Papyrus logging turned on? Post the Papyrus log so we can take a look. It'd be interesting to see if it contains similar "WARNING: Missing or zero refcount on when releasing" messages.

1 hour ago, MisterMorden said:

Mousetick, I noticed you were talking to someone in the posts section of Vanilla Script Micro Optimizations page about using 1.5.97 and the newest version of that mod being a problem...could this be related?

No, I don't think so. The issue with VSMO caused functional breakage but couldn't cause crashes, AFAIK. Also the issue existed depending on which version of USSEP was used, independently of runtime version.

I know for a fact that incorrectly programmed Papyrus scripts can in some cases cause memory corruption and crashes sooner or later, as I experienced it once with one mod. I don't remember the exact details other than the script used out-of-bounds elements in an array, but the resulting crash and its timing wasn't at all like the crash being investigated here. This was a big discovery for me as until then I had assumed the Papyrus VM was memory-safe (like JavaScript for example), but evidently it's not.

2 hours ago, MisterMorden said:

PS I noticed in the thread on this mod page someone else has this crash: https://www.nexusmods.com/skyrimspecialedition/mods/97155?tab=description

FYI Soulmancer here is Kulharin on Nexus. Same person, same crash as they reported here.

[MisterMorden]

13 minutes ago, Mousetick said:

No, I don't think so. The issue with VSMO caused functional breakage but couldn't cause crashes, AFAIK. Also the issue existed depending on which version of USSEP was used, independently of runtime version.

I know for a fact that incorrectly programmed Papyrus scripts can in some cases cause memory corruption and crashes sooner or later, as I experienced it once with one mod. I don't remember the exact details other than the script used out-of-bounds elements in an array, but the resulting crash and its timing wasn't at all like the crash being investigated here. This was a big discovery for me as until then I had assumed the Papyrus VM was memory-safe (like JavaScript for example), but evidently it's not.

Ok thanks for that info!  I was concerned because I am using the last USSEP to work with 1.5.97 as well as the latest VSMO. 

 

13 minutes ago, Mousetick said:

FYI Soulmancer here is Kulharin on Nexus. Same person, same crash as they reported here.

Ah, got it, thanks!

Here is my last crash if it is any help:

https://pastebin.com/C9NLpKA4

Edited February 17 by MisterMorden

[RainingTacco]

@Mousetick

 

Papyrus.3.log

@Mousetick

Papyrus.0 — kopia.log

I dont think its due to memory leak as it happens on game load. Maybe it's trying to reference something that doesn't exist, save that variable in an infinite loop accessing again and again and then overloading VM? Or just simply not being able to reference properly, weird thing that these objects to exist in formid plugin of skyrim and point to some activator like mine or/clay deposit.

[MisterMorden]

Any of y'all use Papyrus Tweaks NG?  I ask because I've been crash free for 24 hrs after making a couple changes to it's ini file (I also rolled back to VSMO version 1.16a and uninstalled Scripts Carefully Reworked Optimized and Tactfully Enhanced mod so it could possibly one of those too but I haven't done further testing yet).

I had MaxOperationsPerTask = 2000 & StackDumpTimeout = 20000 as well as SpeedUpNativeCalls = true.  I reduced these settings to 500, 15000 & false respectively.  I also enabled IgnorePapyrusMemoreLimit = true which was false originally.  Again this is really just a wild stab in the dark, I was trying to eliminate the script altering mods in my LO first and realized after fast traveling and saving all over I've yet to CTD on this save whereas I was crashing every 20 or so minutes before.

Edited February 19 by MisterMorden