AGS: Crash in "The Excavation of Hob's Barrow" on Giving Fiddle Bow to Girl at Devil's Toe

[momomomo888]

Game: The excavation of Hob's Barrow 1.05 (GOG)

SO: MacOSX Ventura 13.0 and iPadOS 16.0

ScummVM versions Tested:

• MacOSX (current daily) 2.8.0git725-g4ff10c52568 (Jan 29 2023 05:11:20)
• iOS master build 2.8.0git (Jan 20 2023 23:45:06)

Case: Just before the third day, when you give the Fiddle to the little girl, there is a cutscene (opening with a close up of the player eyes). It just crash there.

File egines/ags/lib/allegro/surface.cpp
Method BITMAP::draw
line 114

I'm not quite sure what is going there, it seems the game is drawing the room bg on the backbuffer, and the first assert seems to fail. But I think the pixel format is null (??)

[momomomo888]

save game. Give Fiddle to little girl for crash

[digitall]

I hit the same problem a few days back running on latest ScummVM master on Linux x86_64.

The issue is a problem with the AGS engine, no specific to a platform i.e. iOS/OSX

[digitall]

The crash manifests as a segfault on Linux. Running with gdb indicates that this is triggered from:
​https://github.com/scummvm/scummvm/blob/master/engines/ags/lib/allegro/surface.cpp#L114

After some debugging work, I have worked out that the format (which is a reference) is expected to always be valid i.e. not nullptr and thus accessing the fields in the assertion is OK.

In the failing case, the format is nullptr / invalid as the _owner is nullptr (the format is a reference into the _owner). I think the issue is that either _owner is not defined in some cases, or is automatically deleted via a shared pointer losing all valid references (but not accounting for a reference into a reference).

[digitall]

Partial gdb backtrace:

Thread 1 "scummvm" received signal SIGSEGV, Segmentation fault.
0x000055555647049f in AGS3::BITMAP::draw (this=0x5555632f9, srcBitmap=0x5555629f8f38, srcRect=..., dstX=0, dstY=0, horizFlip=false, vertFlip=false, skipTrans=false, srcAlpha=-1, tintRed=-1, tintGreen=-1, tintBlue=-1) at engines/ags/lib/allegro/surface.cpp:114
114		assert(format.bytesPerPixel == 2 || format.bytesPerPixel == 4 ||
(gdb) bt
#0  0x000055555647049f in AGS3::BITMAP::draw (this=0x5555632f9, 
    srcBitmap=0x5555629f8f38, srcRect=..., dstX=0, dstY=0, horizFlip=false, 
    vertFlip=false, skipTrans=false, srcAlpha=-1, tintRed=-1, tintGreen=-1, 
    tintBlue=-1) at engines/ags/lib/allegro/surface.cpp:114
#1  0x000055555646d8d1 in AGS3::blit (src=0x5555629f8f38, dest=0x5555632f9, 
    src_x=340, src_y=3, dst_x=0, dst_y=0, width=160, height=90)
    at engines/ags/lib/allegro/gfx.cpp:106
#2  0x00005555564a27a1 in AGS3::AGS::Shared::Bitmap::Blit (
    this=0x5555632f9a70, src=0x5555662812e0, src_x=340, src_y=3, dst_x=0, 
    dst_y=0, width=160, height=90, mask=AGS3::AGS::Shared::kBitmap_Copy)
    at engines/ags/shared/gfx/allegro_bitmap.cpp:214
#3  0x00005555564d13e7 in AGS3::update_invalid_region (ds=0x5555632f9a70, 
    src=0x5555662812e0, rects=..., no_transform=true)
    at engines/ags/engine/ac/draw_software.cpp:324
#4  0x00005555564d1944 in AGS3::update_room_invreg_and_reset (view_index=0, 
    ds=0x5555632f9a70, src=0x5555662812e0, no_transform=true)
    at engines/ags/engine/ac/draw_software.cpp:402
#5  0x00005555564c9443 in AGS3::draw_room_background (view=0x55555ee840d0)
    at engines/ags/engine/ac/draw.cpp:1805
#6  0x00005555564caf88 in AGS3::construct_room_view ()
    at engines/ags/engine/ac/draw.cpp:2093
#7  0x00005555564cb9c9 in AGS3::construct_game_scene (full_redraw=false)
    at engines/ags/engine/ac/draw.cpp:2189

[digitall]

Added patch with current WIP work on debugging where this crash is introduced and why...

[digitall]

This is still occurring with the latest git master i.e. 944febd1fcc8c1293b14ebf44d3b06ad005a5ce

Still haven't pinned down the issue clearly.

[tag2015]

@digitall
After merging the commits related to the sprite batches the crash no longer occurs (see screenshot, I didn't play till the end, though).
You can test my fork if you want:
​https://github.com/tag2015/scummvm/tree/ags_from_upstream_new

Unfortunately it can't be merged yet because it causes some nasty regressions with old games using the legacy letterbox mode (such as Apprentice or 5 days a stranger).

[tag2015]

Fixed in commit
​4283861
that also affected Dreams in the Witch House.

Game is now completable, with minor graphical glitches.