SAGA: IHNM: "createThread wrong scriptEntryPointNumber" when starting with Benny

[dwatteau]

With either the English/Steam or French/GOG versions of IHNM (which trigger the SAMPLE.AD/SAMPLE.OPL warning), reinstalled from scratch to make sure the data is OK.

For whatever reason, I can only reproduce this with the OSX PowerPC port:

• It also happens with ScummVM 2.2.0, so it's not a recent regression.
• Using different compiler versions doesn't fix the problem.
• It's systematic on this port, i.e. playing with Benny is impossible there.
• With Linux on the same PowerPC machine, it's fine. Maybe the OSX PowerPC environment is "luckier" in triggering this bug, especially if it's related to threading?

Anyway, if I just do this:

1. Start the game
2. Choose Benny as a character
3. Go down the stairs with Benny

then the following error always appears in the console when Benny starts speaking to AM:

Script::createThread wrong scriptEntryPointNumber!

Skipping the dialogue or enabling/disabling the subtitles doesn't change anything.

On Windows, I can't trigger the error message, but sometimes (1 out of 10?) if I reproduce the steps above, Benny suddendly teleports to the cemetery, and if I go back to the previous room, he will resume reacting to AM, as if nothing happened.

GDB and debug logs to be attached below.

[dwatteau]

GDB log when the error happens

[dwatteau]

debug (-d9) log when AM teleports Benny to the first room

[dwatteau]

It's systematic on this port, i.e. playing with Benny is impossible there.

Well, actually there's a way of working around this on this port: look at the Psych Profile in the inventory, before you fall from the stairs with Benny.

It looks like it resets the room to a proper state, and thus prevents the wrong scriptEntryPointNumber error from happening.

[dwatteau]

ASAN (with clang++ on macOS 12.6) detects a heap-use-after-free with the same Benny action. Git HEAD is 20c1dbb50d.

==13418==ERROR: AddressSanitizer: heap-use-after-free on address 0x00011d412a38 at pc 0x000100775ccc bp 0x00016fd61760 sp 0x00016fd61758
READ of size 4 at 0x00011d412a38 thread T0
    #0 0x100775cc8 in Saga::HitZone::getFlags() const objectmap.h:56
    #1 0x1006ec924 in Saga::Actor::stepZoneAction(Saga::ActorData*, Saga::HitZone const*, bool, bool) actor.cpp:551
    #2 0x100712a0c in Saga::Actor::handleActions(int, bool) actor_walk.cpp:695
    #3 0x10071da30 in Saga::Actor::direct(int) actor_walk.cpp:727
    #4 0x1007d2f48 in Saga::SagaEngine::run() saga.cpp:357
    #5 0x1000dc7e0 in runGame(Plugin const*, Plugin const*, OSystem&, Common::String const&) main.cpp:318
    #6 0x1000d8130 in scummvm_main main.cpp:619
    #7 0x1000cf19c in main macosx-main.cpp:44
    #8 0x1024b1088 in start+0x204 (dyld:arm64e+0x5088)

I'm attaching the full ASAN log below.

[dwatteau]

ASAN trace when falling from the stairs with Benny

[dwatteau]

As per #14334 (see comment no. 12) this also happens with the ECS version of Inherit the Earth.

[johnpevensie]

I meant to say the AGA Amiga version of Inherit the Earth. The ECS version of Inherit the Earth works fine.

[PushmePullyu]

Thanks for investigating this and for the ASAN trace. I can not get the "Script::createThread wrong scriptEntryPointNumber!" error message on Linux x86_64, but i have attempted a fix based on the ASAN log: ​https://github.com/PushmePullyu/scummvm/tree/debug-ihnm-use-after-free

[dwatteau]

@johnpevensie: Oops, sorry for inverting them!

Thank you very much @PushmePullyu, here's the ThreadSanitizer trace I manage to get in IHNM-AGA, for reference (attaching it as .txt).

[dwatteau]

@PushmePullyu: I've tested your PR with IHNM: the AddressSanitizer error is now gone, and it appears to fix the createThread wrong scriptEntryPointNumber error on OSX PPC, cool! :)

The ThreadSanitizer errors in IHNM are still there, though (but they look unrelated?), and I couldn't reproduce the original IHNM error on OSX PPC, so I can't say if it fixes both issues yet.

@johnpevensie: Can you grab the updated SAGA plugin at <​https://github.com/dwatteau/scummvm/releases/download/v0.7.1/saga.plugin>, use it to overwrite /Applications/ScummVM.app/Contents/Resources/saga.plugin (from the test build from the other Trac ticket), and report whether this fixes your error in IHNM AGA too? Thanks!

[johnpevensie]

This does not fix the error on the AGA Amiga version of Inherit the Earth. I still get the same error at the same place (after the intro finishes).