Again
I re-trace memory.c and find different behavior between 0.139 and 0.140.
See screenshot. locate_memory() doesn't assign the bank for $4FFF0 - $4FFFF in 0.140 though 0.139 re-assign it to expected memory from ROM region.
"bank->base() == NULL" is FALSE because the base pointer in this bank is already filled at that point though it points to ROM region.
So rough fix is...
if (bank->base() == NULL && bank->references_space(*this, ROW_READWRITE))
to
if (bank->references_space(*this, ROW_READWRITE))
[ATTACHED IMAGE]
"Any company has no power to stop people emulating"
MAME is the emulator of no giving in the pressure from any company even if they don't allow