SCUMM: Crash when activating the context menu in Full throttle

[lgRecip]

Game crash after one second when activating the context menu (the tattoo menu), no matter when you activate the menu, if you keep pressed more than one second it finish by crashing the game. two cd versions of full throttle tested, French and English

This happen with ScummVM 2.3.0git

[criezy]

The issue is not specific with iOS and happen also on macOS and probably other platforms. I could reproduce right at the start of the game. Click first on the bin top to get out of the bin. Then you just have to keep a long left mouse button click on the bin to show the context menu and wait a few seconds.

[criezy]

Bisection indicates that this is introduced by commit 434d1f3 - SCUMM: COMI: implement iMUSE crossfades between regions.

And here is the call stack:

User picked target 'ft-mac-fr' (engine ID 'scumm', game ID 'ft')...
   Looking for a plugin supporting this target... SCUMM [v0-v6 games, v7 & v8 games]
Process 54109 stopped
* thread #14, name = 'SDLTimer', stop reason = EXC_BAD_ACCESS (code=1, address=0x20)
    frame #0: 0x00000001004ed868 scummvm`Scumm::IMuseDigital::switchToNextRegion(this=0x000000010f752e80, track=0x000000010859f2a0) at dimuse.cpp:598:78
   595 			int sampleHookId = _sound->getJumpHookId(soundDesc, jumpId);
   596 			assert(sampleHookId != -1);
   597 	
-> 598 			bool isJumpToStart = (soundDesc->jump[jumpId].dest == soundDesc->marker[2].pos && !scumm_stricmp(soundDesc->marker[2].ptr, "start"));
   599 			bool isJumpToLoop = false;
   600 			if (!isJumpToStart) {
   601 				for (int m = 0; m < soundDesc->numMarkers; m++) {
Target 0: (scummvm) stopped.
(lldb) bt
* thread #14, name = 'SDLTimer', stop reason = EXC_BAD_ACCESS (code=1, address=0x20)
  * frame #0: 0x00000001004ed868 scummvm`Scumm::IMuseDigital::switchToNextRegion(this=0x000000010f752e80, track=0x000000010859f2a0) at dimuse.cpp:598:78
    frame #1: 0x00000001004e68e4 scummvm`Scumm::IMuseDigital::callback(this=0x000000010f752e80) at dimuse.cpp:500:7
    frame #2: 0x00000001004e30b0 scummvm`Scumm::IMuseDigital::timer_handler(refCon=0x000000010f752e80) at dimuse.cpp:43:16
    frame #3: 0x00000001007bc020 scummvm`DefaultTimerManager::handler(this=0x0000000108245980) at default-timer.cpp:111:3
    frame #4: 0x000000010091504c scummvm`timer_handler(interval=10, param=0x0000000108245980) at sdl-timer.cpp:37:34
    frame #5: 0x00000001029998e0 libSDL2-2.0.0.dylib`SDL_TimerThread + 296
    frame #6: 0x0000000102999434 libSDL2-2.0.0.dylib`SDL_RunThread + 48
    frame #7: 0x00000001029e9b5c libSDL2-2.0.0.dylib`RunThread + 12
    frame #8: 0x0000000180e0606c libsystem_pthread.dylib`_pthread_start + 320

[criezy]

As the lldb output above indicates, the issue is that it is dereferencing a null pointer (soundDesc->marker).

[criezy]

It turns out that there was already a pending pull request by AndywinXp (​https://github.com/scummvm/scummvm/pull/2741) to fix this issue. The pull request has now been merged.