Random crash when loading save states

[ppssppfan1]

When loading save states from the quickselect ppsspp graphical menu (the one you get when you hit escape during a game) causes the emulator to crash. It is pretty random, but usually happens on the 4-5 attempt, but could happen on the 2nd try or even the 1st after the emulator has ran a while. The first attempt of loading a state seems to always work after restarting the emulator. I'm using ppsspp-v0.8.1-330-g3643345-windows-amd64 from july 5th running on nvidia hardware.

You can find a mini dump here and the last few lines of the log below:

Code:

48:50:118 user_main    I[HLE]: Font\PGF.cpp:104 Reading 392 bytes of PGF header
48:50:119 user_main    I[HLE]: HLE\sceFont.cpp:484 Loaded font flash0:/font/ltn14.pgf
48:50:119 user_main    I[HLE]: HLE\sceFont.cpp:470 Loading font flash0:/font/ltn15.pgf (43044 bytes)
48:50:119 user_main    I[HLE]: FileSystems\DirectoryFileSystem.cpp:303 Actually opening W:\psp\ppsspp\flash0\font\ltn15.pgf (/font/ltn15.pgf)
48:50:119 user_main    I[HLE]: Font\PGF.cpp:104 Reading 392 bytes of PGF header
48:50:120 user_main    I[HLE]: HLE\sceFont.cpp:484 Loaded font flash0:/font/ltn15.pgf
48:50:120 user_main    I[HLE]: HLE\sceFont.cpp:470 Loading font flash0:/font/kr0.pgf (394192 bytes)
48:50:120 user_main    I[HLE]: FileSystems\DirectoryFileSystem.cpp:303 Actually opening W:\psp\ppsspp\flash0\font\kr0.pgf (/font/kr0.pgf)
48:50:120 user_main    I[HLE]: Font\PGF.cpp:104 Reading 392 bytes of PGF header
48:50:123 user_main    I[HLE]: HLE\sceFont.cpp:484 Loaded font flash0:/font/kr0.pgf
48:50:129 user_main    I[COMMON]: C:\BuildAgent\work\acf56f986e98e7c9\common\ChunkFile.h:664 ChunkReader: Done loading W:\psp\ppsspp\memstick\PSP\PPSSPP_STATE\NPJH50515_1.00_0.ppst
48:50:185 user_main    I[HLE]: GLES\Framebuffer.cpp:548 Creating FBO for 00000000 : 480 x 272 x 3
48:50:243 idle0        I[HLE]: GLES\Framebuffer.cpp:1170 Decimating FBO for 00088000 (480 x 272 x 3), age 1071349
48:50:243 idle0        I[HLE]: GLES\Framebuffer.cpp:1170 Decimating FBO for 00000000 (480 x 272 x 3), age 1071349
48:50:334 user_main    I[HLE]: GLES\Framebuffer.cpp:548 Creating FBO for 00088000 : 480 x 272 x 3
48:56:537 user_main    I[COMMON]: SaveState.cpp:231 Loading state from W:\psp\ppsspp\memstick\PSP\PPSSPP_STATE\NPJH50515_1.00_1.ppst
48:56:537 user_main    I[COMMON]: C:\BuildAgent\work\acf56f986e98e7c9\common\ChunkFile.h:586 ChunkReader: Loading W:\psp\ppsspp\memstick\PSP\PPSSPP_STATE\NPJH50515_1.00_1.ppst
48:56:614 user_main    I[HLE]: GLES\Framebuffer.cpp:1186 Destroying FBO for 00000000 : 480 x 272 x 3
48:56:614 user_main    I[HLE]: GLES\Framebuffer.cpp:1186 Destroying FBO for 00088000 : 480 x 272 x 3
48:56:617 user_main    I[COMMON]: C:\BuildAgent\work\acf56f986e98e7c9\common\ChunkFile.h:664 ChunkReader: Done loading W:\psp\ppsspp\memstick\PSP\PPSSPP_STATE\NPJH50515_1.00_1.ppst

While I don't think it has to do with the actual save state itself since loading it after restarting works, just for completeness, here is the one that is crashed on.