GOB: Adibou 2 (Demo): random setGoblinState() SIGSEGV at game start

[dwatteau]

Current Git HEAD, with the Adibou 2 French demo (adibou2-demo-win-fr) at: <​https://downloads.scummvm.org/frs/demos/gob/adibou2-dos-demo-fr.zip>

The crash appears around 1 time out of 5, when starting a new game.

In order to trigger it:

1. Start a new game of the demo above
2. Create a new character (or load an exiting character; I've attached mine below)
3. Wait for a new game to start

In the first few seconds of the game (e.g. when there's the visual effect gradually showing Adibou's world, or when Adibou appears on screen and everyone dances a bit), a SIGSEGV can randomly happen.

Here's a quick summary of the crash in GDB:

Program received signal SIGSEGV, Segmentation fault.
0x112c40c0 in Gob::Goblin_v7::setGoblinState (this=0x16d75328, obj=0x16da942a, animState=5791) at engines/gob/goblin_v7.cpp:79
79                              if (animVariablesForState[0] == 0) { 

(gdb) p animVariablesForState
$1 = (int16 *) 0x17a996a4
(gdb) p *animVariablesForState
Cannot access memory at address 0x17a996a4

(gdb) bt
#0  0x112c40c0 in Gob::Goblin_v7::setGoblinState (this=0x16d75328, obj=0x16da942a, animState=5791) at engines/gob/goblin_v7.cpp:79
#1  0x113026ec in Gob::Inter_v7::o7_setGoblinState (this=0x16d038d8) at engines/gob/inter_v7.cpp:324
#2  0x1130bd0c in Common::Functor0Mem<void, Gob::Inter_v7>::operator() (this=0x16bbaa28) at ./common/func.h:397
#3  0x112c7bcc in Gob::Inter::executeOpcodeDraw (this=0x16d038d8, i=85 'U') at engines/gob/inter.cpp:80
#4  0x112d5b00 in Gob::Inter_v1::o1_drawOperations (this=0x16d038d8, params=...) at engines/gob/inter_v1.cpp:1420
#5  0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void, Gob::Inter_v1>::operator() (this=0x16ca2188, v1=...) at ./common/func.h:460
#6  0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=1 '\001', j=14 '\016', params=...) at engines/gob/inter.cpp:91
#7  0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=2) at engines/gob/inter.cpp:323
#8  0x112c93a0 in Gob::Inter::callSub (this=0x16d038d8, retFlag=2) at engines/gob/inter.cpp:352
#9  0x112d260c in Gob::Inter_v1::o1_callSub (this=0x16d038d8, params=...) at engines/gob/inter_v1.cpp:730
#10 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void, Gob::Inter_v1>::operator() (this=0x16db8468, v1=...) at ./common/func.h:460
#11 0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=0 '\000', j=0 '\000', params=...) at engines/gob/inter.cpp:91
#12 0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=0) at engines/gob/inter.cpp:323
#13 0x112d3668 in Gob::Inter_v1::o1_if (this=0x16d038d8, params=...) at engines/gob/inter_v1.cpp:929
#14 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void, Gob::Inter_v1>::operator() (this=0x16c8a860, v1=...) at ./common/func.h:460
#15 0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=0 '\000', j=8 '\b', params=...) at engines/gob/inter.cpp:91
#16 0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=2) at engines/gob/inter.cpp:323
#17 0x112c93a0 in Gob::Inter::callSub (this=0x16d038d8, retFlag=2) at engines/gob/inter.cpp:352
#18 0x112d260c in Gob::Inter_v1::o1_callSub (this=0x16d038d8, params=...) at engines/gob/inter_v1.cpp:730
#19 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void, Gob::Inter_v1>::operator() (this=0x16db8468, v1=...) at ./common/func.h:460

[cut]

Fuller, much longer GDB trace attached below.

[dwatteau]

Full GDB trace when the crash happens

[dwatteau]

The character I've created and which I load before the crash happens (1 time out of 5)