MOHAWK: RIVEN: Jungle Island Fireflies out of bounds Crash

[MDogherra]

-Cyan Employee Bug-

Where: Riven, Scumm daily dev build mingw-w32-master-6237bc6e, Jungle Island in the clearing area where you can take the ride to Crater Island

What: Crash ocurred

This is the console output after the crash:
[2018-06-20 10:54:42] ScummVM 2.1.0git2320-g6237bc6e7b (Jun 20 2018 10:27:04)
[2018-06-20 10:54:42] TAINTED Vorbis FLAC MP3 RGB zLib MPEG2 FluidSynth Theora AAC FreeType2 JPEG PNG
[2018-06-20 10:54:42] --- Log opened.
[2018-06-20 10:58:23] WARNING: Invalid hotspot: (274, 107, 227, 162)!

[dafioram]

This saved game is at the animal puzzle, did you mean to upload another save? Anyways from this save I was able to travel to crater island using the cart on jungle island.

This appears to be the DVD version.

[bgK]

The invalid hotspot warning is well known and happens on Temple island near the dome (card id 377). It's likely not related to the crash.

Are you able to reliably reproduce the crash?

[MDogherra]

Afraid not, I had 3 guys looking at it yestrday, none of them could pull it off a second time

[dafioram]

Wait at one of the nodes on jungle island in the clearing where there are fireflies.

#0  0x00007ffff471ae97 in __GI_raise (sig=sig@entry=6)
    at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff471c801 in __GI_abort () at abort.c:79
#2  0x00007ffff470c39a in __assert_fail_base (fmt=0x7ffff48937d8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555558dfe98 "height > 0 && destY + height <= h", file=file@entry=0x5555558dfe41 "graphics/surface.cpp", line=line@entry=142, function=function@entry=0x5555558e0280 <Graphics::Surface::copyRectToSurface(void const*, int, int, int, int, int)::__PRETTY_FUNCTION__> "void Graphics::Surface::copyRectToSurface(const void*, int, int, int, int, int)") at assert.c:92
#3  0x00007ffff470c412 in __GI___assert_fail (assertion=0x5555558dfe98 "height > 0 && destY + height <= h", file=0x5555558dfe41 "graphics/surface.cpp", line=142, function=0x5555558e0280 <Graphics::Surface::copyRectToSurface(void const*, int, int, int, int, int)::__PRETTY_FUNCTION__> "void Graphics::Surface::copyRectToSurface(const void*, int, int, int, int, int)") at assert.c:101
#4  0x00005555557343d5 in Graphics::Surface::copyRectToSurface(void const*, int, int, int, int, int) (this=0x555555e96ab0, buffer=0x5555569f03b0, srcPitch=1216, destX=72, destY=389, width=3, height=4) at graphics/surface.cpp:142
#5  0x000055555573454f in Graphics::Surface::copyRectToSurface(Graphics::Surface const&, int, int, Common::Rect) (this=0x555555e96ab0, srcSurface=..., destX=72, destY=389, subRect=...) at graphics/surface.cpp:158
#6  0x0000555555609a20 in Mohawk::FliesEffect::restoreEffectsSurface() (this=0x555555e618a0) at engines/mohawk/riven_graphics.cpp:1195
#7  0x000055555560984e in Mohawk::FliesEffect::updateScreen() (this=0x555555e618a0) at engines/mohawk/riven_graphics.cpp:1167
#8  0x0000555555608620 in Mohawk::FliesEffect::update() (this=0x555555e618a0) at engines/mohawk/riven_graphics.cpp:864
#9  0x0000555555608035 in Mohawk::RivenGraphics::updateEffects() (this=0x555556392600) at engines/mohawk/riven_graphics.cpp:750
#10 0x000055555561a115 in Mohawk::RivenStack::onFrame() (this=0x555556ac27f0) at engines/mohawk/riven_stack.cpp:290
#11 0x00005555555fb965 in Mohawk::MohawkEngine_Riven::doFrame() (this=0x555555d375c0) at engines/mohawk/riven.cpp:305
#12 0x00005555555fb370 in Mohawk::MohawkEngine_Riven::run() (this=0x555555d375c0) at engines/mohawk/riven.cpp:201
#13 0x00005555555b54e2 in runGame(Plugin const*, OSystem&, Common::String const&) (plugin=0x555555e060e0, system=..., edebuglevels=...)
    at base/main.cpp:264
#14 0x00005555555b6705 in scummvm_main(int, char const* const*) (argc=1, argv=0x7fffffffdfb8) at base/main.cpp:530
#15 0x00005555555b366c in main(int, char**) (argc=1, argv=0x7fffffffdfb8) at backends/platform/sdl/posix/posix-main.cpp:45

Another instance had: x=605, y=355, w=4, h=3, srcPtr=0x555556a56a5a, srcPitch=1216
and another: x=605, y=355, w=4, h=3, srcPtr=0x555556a56a5a, srcPitch=1216

[bgK]

dafioram, thanks for your help. I was not able to reproduce the issue, but I found an off-by-one issue in the code. The fix in commit b068108 should do it.

The fix will be in daily builds with version 2.1.0git-2321 and up.