#12156 closed defect (fixed)

SCUMM: Crash when activating the context menu in Full throttle

Reported by: lgRecip Owned by: criezy
Priority: normal Component: Engine: SCUMM
Version: Keywords: Context menu
Cc: Game: Full Throttle

Description (last modified by criezy)

Game crash after one second when activating the context menu (the tattoo menu), no matter when you activate the menu, if you keep pressed more than one second it finish by crashing the game. two cd versions of full throttle tested, French and English

This happen with ScummVM 2.3.0git

Change History (4)

comment:1 by criezy, 20 months ago

Component: Port: iOSEngine: SCUMM
Description: modified (diff)
Game: Full Throttle
Summary: Full throttle on ScummVM 2.3.0git IOSSCUMM: Crash when activating the context menu in Full throttle

The issue is not specific with iOS and happen also on macOS and probably other platforms. I could reproduce right at the start of the game. Click first on the bin top to get out of the bin. Then you just have to keep a long left mouse button click on the bin to show the context menu and wait a few seconds.

comment:2 by criezy, 20 months ago

Bisection indicates that this is introduced by commit 434d1f3 - SCUMM: COMI: implement iMUSE crossfades between regions.

And here is the call stack:

User picked target 'ft-mac-fr' (engine ID 'scumm', game ID 'ft')...
   Looking for a plugin supporting this target... SCUMM [v0-v6 games, v7 & v8 games]
Process 54109 stopped
* thread #14, name = 'SDLTimer', stop reason = EXC_BAD_ACCESS (code=1, address=0x20)
    frame #0: 0x00000001004ed868 scummvm`Scumm::IMuseDigital::switchToNextRegion(this=0x000000010f752e80, track=0x000000010859f2a0) at dimuse.cpp:598:78
   595 			int sampleHookId = _sound->getJumpHookId(soundDesc, jumpId);
   596 			assert(sampleHookId != -1);
   597 	
-> 598 			bool isJumpToStart = (soundDesc->jump[jumpId].dest == soundDesc->marker[2].pos && !scumm_stricmp(soundDesc->marker[2].ptr, "start"));
   599 			bool isJumpToLoop = false;
   600 			if (!isJumpToStart) {
   601 				for (int m = 0; m < soundDesc->numMarkers; m++) {
Target 0: (scummvm) stopped.
(lldb) bt
* thread #14, name = 'SDLTimer', stop reason = EXC_BAD_ACCESS (code=1, address=0x20)
  * frame #0: 0x00000001004ed868 scummvm`Scumm::IMuseDigital::switchToNextRegion(this=0x000000010f752e80, track=0x000000010859f2a0) at dimuse.cpp:598:78
    frame #1: 0x00000001004e68e4 scummvm`Scumm::IMuseDigital::callback(this=0x000000010f752e80) at dimuse.cpp:500:7
    frame #2: 0x00000001004e30b0 scummvm`Scumm::IMuseDigital::timer_handler(refCon=0x000000010f752e80) at dimuse.cpp:43:16
    frame #3: 0x00000001007bc020 scummvm`DefaultTimerManager::handler(this=0x0000000108245980) at default-timer.cpp:111:3
    frame #4: 0x000000010091504c scummvm`timer_handler(interval=10, param=0x0000000108245980) at sdl-timer.cpp:37:34
    frame #5: 0x00000001029998e0 libSDL2-2.0.0.dylib`SDL_TimerThread + 296
    frame #6: 0x0000000102999434 libSDL2-2.0.0.dylib`SDL_RunThread + 48
    frame #7: 0x00000001029e9b5c libSDL2-2.0.0.dylib`RunThread + 12
    frame #8: 0x0000000180e0606c libsystem_pthread.dylib`_pthread_start + 320
(lldb) p soundDesc->marker
(Scumm::ImuseDigiSndMgr::Marker *) $1 = 0x0000000000000000
Last edited 20 months ago by criezy (previous) (diff)

comment:3 by criezy, 20 months ago

As the lldb output above indicates, the issue is that it is dereferencing a null pointer (soundDesc->marker).

comment:4 by criezy, 20 months ago

Owner: set to criezy
Resolution: fixed
Status: newclosed

It turns out that there was already a pending pull request by AndywinXp (https://github.com/scummvm/scummvm/pull/2741) to fix this issue. The pull request has now been merged.

Note: See TracTickets for help on using tickets.