Emulator

What steps will reproduce the problem?

1. Recompile trunk (r1869) with flavor=devel for DEBUGFAST.
2. Launch Dolphin GUI.
3. Run MP1.

What is the expected output? What do you see instead?
Dolphin hangs or crashes almost immediately, at least after initializing GL
and before showing the Nintendo logo.

What version of the product are you using? On what operating system?
r1869, Linux x86-64,

Please provide any additional information below.
Partial backtrace:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x40b08950 (LWP 11532)]
0x00007f1937a29e11 in __Log (fmt=0x1013 <Address 0x1013 out of bounds>)
at Source/Plugins/Plugin_VideoOGL/Src/Globals.cpp:86
86 void __Log(const char *fmt, ...)
(gdb) bt
#0 0x00007f1937a29e11 in __Log (fmt=0x1013 <Address 0x1013 out of bounds>)
at Source/Plugins/Plugin_VideoOGL/Src/Globals.cpp:86
#1 0x00007f1937a613ed in Pos_ReadDirect_Float ()
at Source/Core/VideoCommon/Src/VertexLoader_Position.cpp:138
#2 0x00000000414e402c in ?? ()
#3 0x00007f1937a5a8fb in VertexLoader::RunVertices (this=0x7f1928600ad0,
vtx_attr_group=0, primitive=3, count=4)
at Source/Core/VideoCommon/Src/VertexLoader.cpp:637
#4 0x00007f1937a3ac46 in VertexLoaderManager::RunVertices (vtx_attr_group=0,
primitive=3, count=4)
at Source/Plugins/Plugin_VideoOGL/Src/VertexLoaderManager.cpp:93
#5 0x00007f1937a4c2d1 in Decode ()
at Source/Core/VideoCommon/Src/OpcodeDecoding.cpp:284

Seems like something is going wrong with LOG_VTX. Let's disassemble the call:

+111: mov 0x230441(%rip),%rax # 0x7f1f12d5a7e0
+118: mov (%rax),%rax
+121: add $0x8,%rax
+125: movss (%rax),%xmm0
+129: unpcklps %xmm0,%xmm0
+132: cvtps2pd %xmm0,%xmm2
+135: mov 0x230429(%rip),%rax # 0x7f1f12d5a7e0
+142: mov (%rax),%rax
+145: add $0x4,%rax
+149: movss (%rax),%xmm0
+153: unpcklps %xmm0,%xmm0
+156: cvtps2pd %xmm0,%xmm1
+159: mov 0x230411(%rip),%rax # 0x7f1f12d5a7e0
+166: mov (%rax),%rax
+169: movss (%rax),%xmm0
+173: unpcklps %xmm0,%xmm0
+176: cvtps2pd %xmm0,%xmm0
+179: lea 0x1a5a9(%rip),%rdi # 0x7f1f12b4498c
+186: mov $0x3,%eax
+191: callq 0x7f1f12af2d93 <_Z5__LogPKcz>

0x7f1f12b4498c contains "vtx: %f %f %f, ", and the others are obviously
((float*)VertexManager::s_pCurBufferPointer)[0] to [2].

fmt is passed as rdi, the length of the vargs is passed as eax and xmm0 to
xmm2 contain the vargs. So why does gdb say __Log interpretes it as 0x1013?