TITANIC: Assertion failure using volume slider

[csnover]

Build: 6fac0ace2c844aa68c2482362021981ed1db931b + PR 975, macOS 10.11, SDL 2.0.5, ASan on

Reproduction:

This bug is not consistently reproducible using these instructions. Sometimes it takes a few tries of dragging before it breaks. Reproducibility seemed to be improved by fast mouse movement and by interacting with the right quarter of the black slider, but that could be coincidental.

1. Load attached save
2. Click on volume button in the settings panel
3. Click on the black slider for Master volume until the music fades out (not sure if this step is required)
4. Mouse down on the Master volume black slider, drag, release

Expected: No crash (not sure what the correct behaviour here is supposed to be, probably either snapping the volume back to its original position or setting it to wherever it is when the mouse button is released)
Actual: Crash

Console output:

Assertion failed: (_hideCounter >= 0), function decHideCounter, file scummvm/engines/titanic/support/mouse_cursor.cpp, line 109.

Backtrace:

[...]
#4	0x0000000100236be4 in Titanic::CMouseCursor::decHideCounter() at scummvm/engines/titanic/support/mouse_cursor.cpp:109
#5	0x000000010000853f in Titanic::CCarry::MouseDragEndMsg(Titanic::CMouseDragEndMsg*) at scummvm/engines/titanic/carry/carry.cpp:126
#6	0x0000000100020f55 in Titanic::CPhotograph::MouseDragEndMsg(Titanic::CMouseDragEndMsg*) at scummvm/engines/titanic/carry/photograph.cpp:71
#7	0x00000001001443a1 in Titanic::CMessage::perform(Titanic::CTreeItem*) at scummvm/engines/titanic/messages/messages.cpp:105
#8	0x0000000100143ef4 in Titanic::CMessage::execute(Titanic::CTreeItem*, Titanic::ClassDef const*, int) at scummvm/engines/titanic/messages/messages.cpp:58
#9	0x00000001002db755 in Titanic::CInputHandler::processMessage(Titanic::CMessage*) at scummvm/engines/titanic/input_handler.cpp:110
#10	0x00000001002dad5a in Titanic::CInputHandler::handleMessage(Titanic::CMessage&, bool) at scummvm/engines/titanic/input_handler.cpp:69
#11	0x00000001002dc7bc in Titanic::CInputTranslator::leftButtonUp(int, Common::Point const&) at scummvm/engines/titanic/input_translator.cpp:60
#12	0x00000001002e06d1 in Titanic::CMainGameWindow::leftButtonUp(Common::Point const&) at scummvm/engines/titanic/main_game_window.cpp:286
#13	0x00000001002d1766 in Titanic::Events::pollEvents() at scummvm/engines/titanic/events.cpp:103
#14	0x00000001002d20a1 in Titanic::Events::pollEventsAndWait() at scummvm/engines/titanic/events.cpp:109
#15	0x00000001002e571d in Titanic::TitanicEngine::run() at scummvm/engines/titanic/titanic.cpp:144
#16	0x000000010047ecf7 in runGame(PluginSubclass<MetaEngine> const*, OSystem&, Common::String const&) [inlined] at scummvm/base/main.cpp:263
#17	0x000000010047eb14 in ::scummvm_main(int, const char *const *) at scummvm/base/main.cpp:529
#18	0x000000010045052a in main at scummvm/backends/platform/sdl/macosx/macosx-main.cpp:45

[dafioram]

Duplicate of #10083.

[csnover]

You’re right, this is very similar to #10083 and probably has the same root cause. (I am going to try advocating again for the ​DuplicateTicketPlugin so this is less likely to happen.)

There is a slight difference in the backtraces, however; the one here has a frame going through CPhotograph. I am not sure if that is just an artefact of different compilers or if there is a more pertinent reason why CPhotograph is in this backtrace and not in the one in #10083.