Opened 18 years ago

Closed 18 years ago

#2771 closed defect (fixed)

WINCE: Monkey Island crash

Reported by: SF/gamer_man Owned by: fingolfin
Priority: normal Component: Engine: SCUMM
Version: Keywords:
Cc: Game: Monkey Island 1

Description

When I use yellow petal whit stewed meat I get an error: Unrecoverable exception ocurred - see crash dump in latest \scummvmCrash file

And I can't find that file.

I Use Windows Mobile 2005 spanish version, pocket PC DELL Axim x51v and The Secret of Monkey Island Spanish/DOS/VGA

Ticket imported from: #1535358. Ticket imported from: bugs/2771.

Attachments (2)

scummvmCrash_25_07_2006_14_47_19.txt​ (807 bytes ) - added by SF/gamer_man 18 years ago.
Crash Dump
setOwner.txt​ (2.7 KB ) - added by Kirben 18 years ago.
setOwner disasm.

Download all attachments as: .zip

Change History (61)

comment:1 by SF/gamer_man, 18 years ago

I found the file.

by SF/gamer_man, 18 years ago

Attachment: scummvmCrash_25_07_2006_14_47_19.txt​ added

Crash Dump

comment:2 by SF/pechecv2, 18 years ago

Same thing is happening to me, but in Windows Xp Spanisg.

The game is also Monkey Island 1 VGA in Spanish, and the crash happnes when i use the yellow flower whit the meat.

It just closes, with no error.

comment:3 by SF/knakos, 18 years ago

The crash happens (with high propability) inside o6_walkActorToObj of script_v6.obj. Can you attach a savegame just before this happens? Since it is reported in the plain windows port as well, it might be engine and not backend specific.

comment:4 by SF/therealmaw, 18 years ago

same here on a mda-vario with wm2005 german and mi1 german/dos/vga.

crashdump:

---------------------------------------- Exception Access Violation Flags 00000000 Address 002278a0 Parameter 0 00000000 Parameter 1 2265f0d6 ---------------------------------------- Context dump R0=0065eede R1=00665d6c R2=0065ee40 R3=0065f0d6 R4=00660030 R5=0000029e R6=00000000 R7=00000000 R8=0066a030 R9=0066b030 R10=0066b030 R11=0066b030 R12=2edd07c3 Sp=2240f81c Lr=0000004f Pc=002278a0 Psr=60000010 ---------------------------------------- Memory dump at 0022786e ff eb 0b 3a 84 e2 05 38 d3 e5 03 31 83 e0 03 31 84 e0 5d 1c 83 e2 b4 30 d1 e5 00 00 53 e3 12 00 00 1a 02 39 84 e2 cc 24 93 e5 bc 3a d1 e1 83 30 82 e0 b0 30 d3 e1 05 00 53 e1 0b 00 00 1a 00 20 a0 e3 05 10 a0 e1 04 00 a0 e1 17 fa ff eb 00 30 94 e5 06 10 a0 e1 04 00 a0 e1 0f e0 a0 e1 54 f0 93 e5 04 00

comment:5 by SF/knakos, 18 years ago

please attach a savegame right before the crash happens so I can test it.

comment:6 by fingolfin, 18 years ago

This may be caused by a corrupt savegame... See also bug #803526 <https:// sourceforge.net/tracker/index.php? func=detail&aid=803526&group_id=37116&atid=418820>.

Can you reproduce the issue with a freshly started game (getting to the flower/ meat can be done very quickly, after all) ? And how old is your savegame?

comment:7 by fingolfin, 18 years ago

Owner: set to SF/knakos
Summary: WINCE (WM2005)- scummvm 0.9.0a - Monkey Island 1 crash → WINCE: Monkey Island crash

comment:8 by SF/knakos, 18 years ago

actually I played through myself (in the svn branch 0-9-0 version I have)and I cannot reproduce the bug. Lowering the priority on this; If all is ok with 0-9-1 I'll close it.

Thanks, Kostas

comment:9 by SF/knakos, 18 years ago

Priority: normal → low

comment:10 by SF/knakos, 18 years ago

forgot to mention that I have the english version of MI (which *may* make the difference here).

comment:11 by SF/therealmaw, 18 years ago

the savegame is 3 days old and how i can attach a file? ;)

comment:12 by SF/knakos, 18 years ago

For attachments you can use the "Upload and Attach a File" controls at the bottom of this very page.

As finglolfin said, though, the issue is early in the game and can be reproduced easily. The question remains: "Can you reproduce the issue with a freshly started game" ? Also, what scummvm version are you running? Have you tried the one at the "Summer Bonanza" thread in the WinCE forums?

comment:13 by SF/therealmaw, 18 years ago

ok, i have start a new game, first thing was to grab meat and use with the stew, then flower and use it with the meat/stew.

same error

comment:14 by SF/therealmaw, 18 years ago

arg i use scummvm-0.9.0a

comment:15 by SF/knakos, 18 years ago

Priority: low → normal

comment:16 by SF/knakos, 18 years ago

OK I definately cannot reproduce this using the english/dos/ cd version with the following Pocketscumm versions : 0.9.0, 0.9.0a,0.9.0current. It doesn't _seem_ to be ce backend specific. See my previous comment here for an estimation on the function in which the crash occurs. Setting priority to normal again :)

comment:17 by SF/gamer_man, 18 years ago

This error seems to occur only in no-english versions of the game. Can u test this error in non english Monkey Island? Will next version of scummvm 0.9.1 have any fix to this?

Thanks.

comment:18 by fingolfin, 18 years ago

The error does not occur in the german version either. So far the only reproducible reports we had were for the spanish version of the game.

Since we can't reproduce the issue, we can't "fix" it. Hence 0.9.1 won't contain a "fix" for it. And in fact it seems likely to be a problem with the data files, not with ScummVM...

Is this an official LucasArts release of MI, or a fan translation?

comment:19 by SF/therealmaw, 18 years ago

ok. i recopy my original german version to the mda. start a new game. first thing was to grab meat and DONT use with the stew, then grab flower and use it with the meat.

same error

;(

comment:20 by SF/knakos, 18 years ago

1) Try your game on a pc with scummvm 0.9.0 and report if it crashes too. 2) Provide md5 sums of all files of your MI files

comment:21 by SF/knakos, 18 years ago

1) Try your game on a pc with scummvm 0.9.0 and report if it crashes too. 2) Provide md5 sums of all files of your MI files

comment:22 by SF/therealmaw, 18 years ago

1. i crashed on pc too

2.

[Path] / filename MD5 sum ------------------------------------------------------------------------------- [c:\monkey\] 000.LFL
d0b531227a27c6662018d2bd05aac52a 901.LFL
0d01659586aa770608acc8138daae8cc 902.LFL
838b3d8ed6fa615ae561273ae29efafd 903.LFL
6c72dd66cccae6308f962075c314ee16 904.LFL
87edc5c6d4eb64361df02072e08732ce DISK01.LEC
f4762f06c3de37d852ff16f093a06406 DISK02.LEC
b74e2034cac3bb3203ee28d4a7d18d4e DISK03.LEC
b29b164bbd996e18c3387438e5d7a734 DISK04.LEC
a0c2a3b5dadaf6e09ecaa819752aa4a3 MONKEY.EXE
bf345756e26e06453cc761abeae49672 README.VGA
fa7399d3defd9c5b06fd794ee9176cc1

comment:23 by fingolfin, 18 years ago

OK, I have the very same version of monkeyvga/german, but still can't reproduce the issue. We need the *precise* steps you are following now. I did the following, which failed to trigger a crash under OS X (note that I did *nothing* else, in particular I didn't pick up other objects etc.; the precise order is also relevant):

1) start game 2) skip using ESC over the intro etc. 3) walk into the SCUMM bar, enter the kitchen 4) "pick up" the meat from the table. 5) leave the bar, leave the town 6) enter the forest ("Gabelung") 7) Walk through the very first passageway to get to the yellow flowers 8) "pick up" a yellow flower 9) use flower on meat

Is this precisely what you are doing? Or maybe you are doing something in a different order, or are doing something extra / something less?

comment:24 by SF/therealmaw, 18 years ago

yes, this my steps to become the error on pc and mda

comment:25 by fingolfin, 18 years ago

Kirben, could you valgrind this?

comment:26 by fingolfin, 18 years ago

Owner: changed from SF/knakos to Kirben

comment:27 by Kirben, 18 years ago

No problems are reported under Valgrind, when combining those items. I'm using the English version of Monkey Island 1 (VGA) though.

comment:28 by Kirben, 18 years ago

Owner: Kirben removed

comment:29 by Kirben, 18 years ago

I wonder if there is a rare bug somewhere, only triggered when combining certain items sometimes. As we have had several similar common bug reports in games, which we have been unable to reproduce so far.

Monkey Island 1: Using meat with flower

FOA: Using ribcage with another item

DOTT: Using stamp with contract

comment:30 by SF/therealmaw, 18 years ago

ok, here a avi snapshot ... http://www.manatwork.org/video/mi1.avi

good night

comment:31 by fingolfin, 18 years ago

Thanks for the video, therealmaw, it confirms that we are doing the precise same steps. Still doesn't crash for me, though :-/.

Kirben, very good point. My primary suspect is ScummEngine::setOwnerOf in object.cpp. It's been mostly unchanged since the day it was crated by strigeus, but it has this code in it with looks very fishy to me:

... clearOwnerOf(obj); ss = &vm.slot[_currentScript]; if (ss->where == WIO_INVENTORY && _inventory[ss->number] == obj) { ...

What I consider fishy here is the check _inventory[ss->number] == obj which does two odd things: 1) It uses the script number to index the _inventory array, which makes no sense at all to me 2) It check whether the _inventory array contains "obj" -- but clearOwnerOf() removed obj from _inventory...

The V4 code definitely differs, but I have no idea what V5-8 ought to do there... could you compare this to disasm?

comment:32 by fingolfin, 18 years ago

In particular, ss->number is 331 in this case, while _numInventory is 80, so we have an out of bound access.

My guess is that the correct code should check for ss->number == obj and that this check was meant to kill the current script if it belongs to the object we just nuked.

It would be really nice if by fixing this we could finally kill those three long- standing heisenbugs :-)

comment:33 by Kirben, 18 years ago

Our current code for setOwner() seems to match the original code of SCUMM 5-6 engine, I attached diasm. of setOwner opcode in DOTT and Monkey Island 2.

by Kirben, 18 years ago

Attachment: setOwner.txt​ added

setOwner disasm.

comment:34 by fingolfin, 18 years ago

Owner: set to fingolfin

comment:35 by fingolfin, 18 years ago

Indeed, disasm matches (I also just checked the FT disasm). However, it still makes no sense. Right now I am pretty much convinced that this is "simply" a long standing bug in the original SCUMM engine, which they simply never noticed...

My theory still is that this check is supposed to detect when an object script nukes its own object, in which case they try to abort the script early (for safety, I guess). Normally, this situation should never occur.

I see at least three possible ways to go about resolving this:

1) Just remove the check completely. Given that normally it should never succeed (except by pure random coincidence), this should be fairly safe, but has a very small chance of leading to regressions.

2) Keep the check. but do not blindly access _inventory, rather check whether ss->number < _numInventory. This way we stay close to the original while avoiding the OOB access.

3) Implement the check "properly", that is change the check to "ss->number == obj". However, this is much more likely to lead to regressions, since scripts that previously kept running might be stopped now.

My favorite is 1), but what I'll do now is to implement 2), with warnings added to catch the cases relevant for 1) and 3). Tomorrow's daily build should include my changes, everybody able to reproduce the bug with 0.9.0 please retest then.

comment:36 by fingolfin, 18 years ago

This tracker item is pending response by the submitter; we cannot continue processing it before that happens. As a consequence, its status has been set to "Pending". It will automatically revert to "Open" once a new comment is made to this item. If no response is made within 14 days, it will automatically be closed.

Thank you.

comment:37 by fingolfin, 18 years ago

Status: new → pending

comment:38 by SF/therealmaw, 18 years ago

hmmm ... i have make another tests with xp and my installed scummvm 0.9.0 ... now its works - strange o_O ....under ce crashes every time

mario

comment:39 by SF/gamer_man, 18 years ago

Status: pending → new

comment:40 by SF/gamer_man, 18 years ago

response

comment:41 by SF/knakos, 18 years ago

No gamer_man, the point fingolfin made was: 1) Test if the bug is reproducible also in the (normal) pc version of scummvm 2) Test if the bug is reproducible on the latest SVN build available from the downloads page. Report your results here.

comment:42 by fingolfin, 18 years ago

Status: new → pending

comment:43 by SF/gamer_man, 18 years ago

Status: pending → new

comment:44 by SF/gamer_man, 18 years ago

OK, sorry. I'll do it this weekend, because I'm not at home this week.

comment:45 by fingolfin, 18 years ago

Status: new → pending

comment:46 by fingolfin, 18 years ago

Fine, but until that point, this tracker item shall remain in "pending" status :-)

comment:47 by SF/therealmaw, 18 years ago

gives a new l8test SVN build for win-ce?

comment:48 by SF/knakos, 18 years ago

No, svn builds of the ce port are infrequent and are posted to the forums for the time being. But the codebase is obviously shared between all ports, so grab 0.9.0 for the pc, test your issue and then get the latest svn build, test it again and report your findings.

comment:49 by SF/gamer_man, 18 years ago

Hi again. I used scummvm version 0.8.2 for WINCE. Started new game, get the meat, get the yellow petal and use yellow petal with meat and it works.

I used scummvm version 0.9.0 por PC and same thing. It works.

I used same game: The Secret of Monkey Island Spanish/DOS/VGA in all cases, but in version 0.9.0a for WINCE it crashes.

Any suggestion?

comment:50 by SF/gamer_man, 18 years ago

Status: pending → new

comment:51 by SF/knakos, 18 years ago

Owner: changed from fingolfin to SF/knakos

comment:52 by SF/knakos, 18 years ago

so, this comes back to me *sigh*. anyway, one more test (since I can't remember if I updated the codebase between 0.9.0 and 0.9.0a): run this one (it's the wince port): http://users.uoa.gr/~knakos/scummvm/binaries/scummvm- 0.9.0svn-20060730.bz2

(rename the unbzipped file to include .exe). I hope it's not optimizer trouble again.

PS. Be aware that since I don't have the means to directly check the issue, you may be doing a few rounds of testing for me.

comment:53 by SF/gamer_man, 18 years ago

Hi again. I used scummvm version 0.8.2 for WINCE. Started new game, get the meat, get the yellow petal and use yellow petal with meat and it works.

I used scummvm version 0.9.0 por PC and same thing. It works.

I used same game: The Secret of Monkey Island Spanish/DOS/VGA in all cases, but in version 0.9.0a for WINCE it crashes.

Any suggestion?

comment:54 by SF/gamer_man, 18 years ago

Owner: changed from SF/knakos to fingolfin
Status: new → pending

comment:55 by SF/gamer_man, 18 years ago

Hi there. I tried scummvm-0.9.0svn-20060730. Starting a new game and using yellow petal whith meat, don't crashes.Then I tried to do more things before use petal with meat. Never crashes.

And then I tried to load a game saved with scummvm 0.9.0a just before use yellow petal whit meat, and this time don't crash.

Since that, I only use 0.9.0 SVN for WINCE verision.

What's going on with 0.9.0a version?

comment:56 by SF/gamer_man, 18 years ago

Status: pending → new

comment:57 by SF/knakos, 18 years ago

I can't say for sure but since 0.9.0 the branch has more of the good stuff (tm) in it. Fingolfin note that the svn build is 30 July 2006, if you wat to check on things. Can we close it now Max?

comment:58 by fingolfin, 18 years ago

Resolution: → fixed
Status: new → closed

comment:59 by fingolfin, 18 years ago

Closing it. I have no idea if the bug really has been fixed (it's simply impossible to be certain, due to the nature of this (heisen) bug). But I am relatively confident that I nailed it (and it's siblings) with that fix I made... So let's just hope I am right :-)

Note: See TracTickets for help on using tickets.