QFG4: Crash when walking around the squid monolith

[Vhati]

ScummVM 2.1.0git3770-g15306581ab (Oct 18 2018 04:27:32)
Windows 7 64bit
QFG4 CD (English)

After I initially emerge from the cave and slide down the gooey path...

The game crashes when I attempt to walk around the squid monolith from a NW position toward a point on the right of it. The walk cycle slides when a crash is imminent. Attempting to grab the bonsai bush can also cause a walk + crash just before the narrator would say you can't reach it.

The attached save is already standing at a problematic spot, ready to trigger a crash.

" " "
lookupSelector: Attempt to send to non-object or invalid script. Address 0000:0000, method Grycler::init (room 800, script 64977, localCall ffffffff)!
" " "

File - 5kb MD5 - Full MD5
RESOURCE.000 - 263dce4aa34c49d3ad29bec889007b1c - 1364ba69e3c0abb68cc0170650a56692
RESOURCE.AUD - c39521bffb1d8b19a57394866184a0ca - 71098b9e97e20c8941c0e4812d5f906f
RESOURCE.MAP - aba367f2102e81782d961b14fbe3d630 - 801a04cc6aa5d437681a2dd0b6545248
RESOURCE.SFX - 3cf95e09dab8b11d675e0537e18b499a - 7c858d7253f86dab4cc6066013c5ecec

[Vhati]

SavedGame - Squid Monolith

[Vhati]

I wasn't able to reproduce this with the floppy edition under ScummVM.

ScummVM 2.1.0git3770-g15306581ab (Oct 18 2018 04:27:32)
Windows 7 64bit
QFG4 Floppy 1.1a + note patch (English)

File - 5kb MD5 - Full MD5
RESOURCE.000 - f64fd6aa3977939a86ff30783dd677e1 - ff42260a665995a85aeb277ad80aac8a
RESOURCE.MAP - d10a4cc177d2091d744e2ad8c049b0ae - 3695b1b0a1d15f3d324ea9f0cc325245
RESOURCE.SFX - 3cf95e09dab8b11d675e0537e18b499a - 7c858d7253f86dab4cc6066013c5ecec

[Vhati]

backtrace

script 64992 - Motion::init(); pc=0017:0456
script 64998 - hero::setHeading(0000:004e); pc=0006:0f31
script 28 - stopGroop::doit(hero, 0000:004e, 0); pc=0013:01b12
script 64977 - Grooper::doit(hero, 0000:004e, 0); pc=0015:022e
script 64998 - hero::setCycle(Grycler, stopGroop, 0000:0002); pc=0006:06af
script 64977 - Grycler::init(hero, stopGroop, 0000:0002); pc=0015:0309 is the crashing opcode

Stepping through until it crashes...

# Indented to match each send with its pushes.

0015:02f3: 38 96 00       pushi	0096		; isKindOf
0015:02f6: 78             push1
0015:02f7: 51 59          class	StopWalk[59], 
0015:02f9: 36             push 

	0015:02fa: 38 47 02       pushi	0247		; oldCycler
	0015:02fd: 76             push0

		0015:02fe: 39 47          pushi	47		; looper
		0015:0300: 76             push0
		0015:0301: 63 14          pToa 	client[14]	(client)

		0015:0303: 4a 04 00       send 	0004
		  hero::looper[VAR]()

	0015:0306: 4a 04 00       send 	0004
	  stopGroop::oldCycler[VAR]()

0015:0309: 4a 06 00       send  0006
  <no such object>::isKindOf[INVALID_OBJ](StopWalk)

lookupSelector: Attempt to send to non-object or invalid script.
Address 0000:0000, method Grycler::init (room 800, script 64977, localCall ffffffff)!

At that moment, hero's "looper" property is stopGroop.
stopGroop's "oldCycler" property is 0000:0000.


Grycler::init()

	(method (init param1 theCaller theLoopIndex)
		(super init: param1)
		(= caller theCaller)
		(= numOfLoops (if (< (NumLoops client) 8) 4 else 8))
		(= cycleDir
			(-
				(proc64999_0
					(proc64982_2 (* theLoopIndex 45) (param1 heading?))
				)
			)
		)
		(= loopIndex theLoopIndex)
		(if (self loopIsCorrect:)
			(if
				(and
					(((client looper?) oldCycler?) isKindOf: StopWalk)
					(== (((client looper?) oldCycler?) vStopped?) -1)
				)
				(client loop: [local8 loopIndex])
			)
			(self cycleDone:)
		)
	)

[Vhati]

I guess that isKindOf() AND condition needs an "is oldCycler > 0" check above it.

As seen with cycler in stopGroop::doit().

	(method (doit)
		(if
			(and
				(global0 cycler?)
				((global0 cycler?) isKindOf: StopWalk)
			)
			(global0 view: ((global0 cycler?) vWalking?))
		)
		(super doit: &rest)
	)

[Vhati]

Nah. That just staves off the crash until something else chokes on the null, all the while hero skates around. So the null assignment needs to be prevented somewhere.

Diffed Grooper/Grycler against the same script in SQ6 Demo, released a year later. Slightly more efficient but nothing that'd fix this.

[Vhati]

oldCycler is already null the moment the OP savegame is restored.

[Vhati]

the null assignment needs to be prevented somewhere.

"setCycle: 0" occurs frequently throughout the game.

Scripts: 270, 290, 360, 440, 460, 500, 579, 600, 630, 670, 680, 730, 750, 760, 770, 780, 800, 803, 64998

On hero, it's usually temporary (not always), and a new cycler is assigned at a later state within the same Script object that nulled it.

A null cycler should be tolerated in general then.

all the while hero skates around

This null assignment is still bad.

[Vhati]

Possibly related?: #9801 (Crash when sliding down slippery slope)

[sluicebox]

​https://github.com/scummvm/scummvm/pull/1711

[Filippos Karapetis <bluegr@…>]

In c1610a9f:

SCI32: Fix QFG4CD Grooper crashes at inn and monolith

Fixes bugs #10747, #10760