[Bug 55903] Falcon BMS 4.37u3: game randomly fails to load 3D models

[WineHQ Bugzilla]

https://bugs.winehq.org/show_bug.cgi?id=55903

Matheus Ribeiro  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]

--- Comment #7 from Matheus Ribeiro  ---
(In reply to Fabian Maurer from comment #2)
> Does it work reliably with wine-8.14? If so, could you do a regression test
> to see what broke it?
> > Essentially, its a pointer trick. Lodidx comes from the object memory address - the first object in the array. its pointer arithmetics, something which is not recommended, but works.
> > const int lodIdx = static_cast<int>(this - TheObjectLODs);
>
> I don't quite understand it yet. For now it looks more like undefined
> behavior to me. Seems like "TheObjectLODs" is bigger than "this", thus you
> get some massive negative value. If it the same object from one single(!)
> allocation I don't see how this could go wrong.
> A bigger code snippet could help cast light on this, but I doubt the'll be
> willing to provide that.

Hi Fabian, BMS dev here.

TheObjectLODs is a global array, populated during application startup. All
ObjectLOD used are in this array (and first position is invalid). So, `this`,
is one of those objects. When we do `this - ObjectLOD` we are essentially
computing the index.

Notice that pointer subtraction is well defined behavior (contrary to pointer
addition, which makes no sense). And the number of LODs is a few tens of
thousands, so it is not an integer overflow.

The offending code is here:

```
void ObjectLOD::Load()
{
    PROFILE( ObjectLOD_Load );

const int lodIdx = static_cast<int>(this - TheObjectLODs);
    g_nLoadingLOD = lodIdx;
    if (lodIdx < 0) {
        NL_MONOPRINT(NL_ERROR, "Skipping LOD load, lodIdx is negative: %d",
lodIdx);
        return;
    }
```

Not much to show from this, but let me know if you need more information.