From 2390f4883ebec42dc579a34395d074aeeacb8d34 Mon Sep 17 00:00:00 2001 From: ejams1 Date: Fri, 2 Oct 2026 18:12:57 -0600 Subject: [PATCH] Fix the IVirtualMachine::CreateObject overload order MSVC lays out overloaded virtuals in reverse declaration order, which is why every other overload pair in this header is declared in reverse slot order. The CreateObject pair was declared in slot order, so CreateObject(name, obj) compiled to slot 0x16, which in 1.11.240 is CreateObject(name, properties, obj) (0x2119990), while the two-argument overload is slot 0x17 (0x2119930: mov r9, r8; xor r8d, r8d; call [rax+48h]). PackVariable reaches it for any form with no bound script object, and the engine then reads the garbage out-pointer and crashes at Fallout4.exe+0x211edd0. Co-Authored-By: Claude Opus 5.5 --- include/RE/B/BSScript_IVirtualMachine.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/RE/B/BSScript_IVirtualMachine.h b/include/RE/B/BSScript_IVirtualMachine.h index d4d84c6ce..e5d148690 100644 --- a/include/RE/B/BSScript_IVirtualMachine.h +++ b/include/RE/B/BSScript_IVirtualMachine.h @@ -67,8 +67,8 @@ namespace RE virtual bool GetScriptStructType(const BSFixedString& a_structTypeName, BSTSmartPointer& a_structType) = 0; // 13 virtual bool GetScriptStructTypeNoLoad(const BSFixedString& a_structTypeName, BSTSmartPointer& a_structType) const = 0; // 14 virtual bool GetChildStructTypes(const BSFixedString& a_parentObjectName, BSTObjectArena& a_structTypes) const = 0; // 15 - virtual bool CreateObject(const BSFixedString& a_objectTypeName, const BSTScrapHashMap& a_properties, BSTSmartPointer& a_newObj) = 0; // 16 virtual bool CreateObject(const BSFixedString& a_objectTypeName, BSTSmartPointer& a_newObj) = 0; // 17 + virtual bool CreateObject(const BSFixedString& a_objectTypeName, const BSTScrapHashMap& a_properties, BSTSmartPointer& a_newObj) = 0; // 16 virtual bool CreateStruct(const BSFixedString& a_structTypeName, BSTSmartPointer& a_newStruct) = 0; // 18 virtual bool CreateArray(TypeInfo::RawType a_elementType, const BSFixedString& a_elementObjectTypeName, std::uint32_t a_elementCount, BSTSmartPointer& a_newArray) = 0; // 1A virtual bool CreateArray(const TypeInfo& a_type, std::uint32_t a_elementCount, BSTSmartPointer& a_newArray) = 0; // 19