Shield Burn Crash

For years, it's been known that burning your shield as a child during the tower collapse sequence could result in a crash. In Jan of 2013, I made a video showing that the crash was related in some way to Zelda, but never came to any specific conclusion on what causes the crash. Today I looked into it again, and with the help of the Ocarina of Time Decompilation project I've been able to figure out with certainty the cause of the crash.

For those less familiar to N64 display lists, the N64 uses what's referred to as a segment address system. This system allows files to be given an address at compile time that isn't locked to a specific ram address. Using this system, a display list in one file can reference a display list in another file, or even a display list generated at runtime, without having to know it's exact address beforehand. The N64 uses 16 segments, numbered 0x00-0x0F, and aside from segment 0x00, they can be freely assigned and re-assigned to different ram addresses however the programmer sees fit.

Under certain contexts, the Zelda64 engine will automatically initialize a few of the segments for the programmer. For example, whenever an actor is running, the following segments will be pre-initialized for the programmer:

Segment 02 = Current Scene
Segment 03 = Current Room
Segment 04 = gameplay_keep (common display lists, textures, animations)
Segment 05 = gameplay_field_keep or gameplay_dangeon_keep (overworld/dungeon common stuffs)
Segment 06 = The actor's current object file dependency

The rest is up to the programmer to initialize. Going back to the Deku Shield, its display contains a jump to a display list at segment 0x0C. When the Deku Shield is drawn by the player actor, the player actor properly initializes segment 0x0C to point to the display list gCullBackDList. But, When you burn the Deku Shield, a different actor called Item_Shield is used to draw the shield separate from Link. And most importantly, Item_Shield does NOT initialize segment 0x0C before drawing the shield.

And this is where Zelda (en_zl3) comes in. Zelda's display lists use segment 0x0C to point to a series of matrices. And since Zelda is processed after Link but before Item_Shield, segment 0x0C no longer points to the proper data, and results in a game crash.

Given this new insight, i find it rather interesting that burning the shield does not crash in more places than it already does. Perhaps once decomp has progressed further we'll have a better way to check what actors use segment 0x0C, and maybe find more oddities with this effect.