Opened 13 years ago

Closed 13 years ago

#2771 closed defect (fixed)

WINCE: Monkey Island crash

Reported by: SF/gamer_man Owned by: fingolfin
Priority: normal Component: Engine: SCUMM
Keywords: Cc:
Game: Monkey Island 1

Description

When I use yellow petal whit stewed meat I get an
error:
Unrecoverable exception ocurred - see crash dump in
latest \scummvmCrash file

And I can't find that file.

I Use Windows Mobile 2005 spanish version, pocket PC
DELL Axim x51v and The Secret of Monkey Island
Spanish/DOS/VGA

Ticket imported from: #1535358. Ticket imported from: bugs/2771.

Attachments (2)

scummvmCrash_25_07_2006_14_47_19.txt (807 bytes) - added by SF/gamer_man 13 years ago.
Crash Dump
setOwner.txt (2.7 KB) - added by Kirben 13 years ago.
setOwner disasm.

Download all attachments as: .zip

Change History (61)

comment:1 Changed 13 years ago by SF/gamer_man

I found the file.

Changed 13 years ago by SF/gamer_man

Crash Dump

comment:2 Changed 13 years ago by SF/pechecv2

Same thing is happening to me, but in Windows Xp Spanisg.

The game is also Monkey Island 1 VGA in Spanish, and the
crash happnes when i use the yellow flower whit the meat.

It just closes, with no error.

comment:3 Changed 13 years ago by SF/knakos

The crash happens (with high propability) inside
o6_walkActorToObj of script_v6.obj. Can you attach a
savegame just before this happens? Since it is reported in
the plain windows port as well, it might be engine and not
backend specific.

comment:4 Changed 13 years ago by SF/therealmaw

same here on a mda-vario with wm2005 german and mi1
german/dos/vga.

crashdump:

----------------------------------------
Exception Access Violation Flags 00000000 Address 002278a0
Parameter 0 00000000
Parameter 1 2265f0d6
----------------------------------------
Context dump
R0=0065eede R1=00665d6c R2=0065ee40 R3=0065f0d6 R4=00660030
R5=0000029e R6=00000000 R7=00000000 R8=0066a030 R9=0066b030
R10=0066b030 R11=0066b030 R12=2edd07c3
Sp=2240f81c Lr=0000004f Pc=002278a0 Psr=60000010
----------------------------------------
Memory dump at 0022786e
ff eb 0b 3a 84 e2 05 38
d3 e5 03 31 83 e0 03 31
84 e0 5d 1c 83 e2 b4 30
d1 e5 00 00 53 e3 12 00
00 1a 02 39 84 e2 cc 24
93 e5 bc 3a d1 e1 83 30
82 e0 b0 30 d3 e1 05 00
53 e1 0b 00 00 1a 00 20
a0 e3 05 10 a0 e1 04 00
a0 e1 17 fa ff eb 00 30
94 e5 06 10 a0 e1 04 00
a0 e1 0f e0 a0 e1 54 f0
93 e5 04 00

comment:5 Changed 13 years ago by SF/knakos

please attach a savegame right before the crash happens so
I can test it.

comment:6 Changed 13 years ago by fingolfin

This may be caused by a corrupt savegame... See also bug #803526 <https://
sourceforge.net/tracker/index.php?
func=detail&aid=803526&group_id=37116&atid=418820>.

Can you reproduce the issue with a freshly started game (getting to the flower/
meat can be done very quickly, after all) ? And how old is your savegame?

comment:7 Changed 13 years ago by fingolfin

Owner: set to SF/knakos
Summary: WINCE (WM2005)- scummvm 0.9.0a - Monkey Island 1 crashWINCE: Monkey Island crash

comment:8 Changed 13 years ago by SF/knakos

actually I played through myself (in the svn branch 0-9-0
version I have)and I cannot reproduce the bug. Lowering the
priority on this; If all is ok with 0-9-1 I'll close it.

Thanks,
Kostas

comment:9 Changed 13 years ago by SF/knakos

Priority: normallow

comment:10 Changed 13 years ago by SF/knakos

forgot to mention that I have the english version of MI
(which *may* make the difference here).

comment:11 Changed 13 years ago by SF/therealmaw

the savegame is 3 days old and how i can attach a file? ;)

comment:12 Changed 13 years ago by SF/knakos

For attachments you can use the "Upload and Attach a File"
controls at the bottom of this very page.

As finglolfin said, though, the issue is early in the game
and can be reproduced easily. The question remains: "Can
you reproduce the issue with a freshly started game" ?
Also, what scummvm version are you running? Have you tried
the one at the "Summer Bonanza" thread in the WinCE forums?

comment:13 Changed 13 years ago by SF/therealmaw

ok, i have start a new game, first thing was to grab meat
and use with the stew, then flower and use it with the
meat/stew.

same error

comment:14 Changed 13 years ago by SF/therealmaw

arg i use scummvm-0.9.0a

comment:15 Changed 13 years ago by SF/knakos

Priority: lownormal

comment:16 Changed 13 years ago by SF/knakos

OK I definately cannot reproduce this using the english/dos/
cd version with the following Pocketscumm versions : 0.9.0,
0.9.0a,0.9.0current. It doesn't _seem_ to be ce backend
specific. See my previous comment here for an estimation on
the function in which the crash occurs. Setting priority to
normal again :)

comment:17 Changed 13 years ago by SF/gamer_man

This error seems to occur only in no-english versions of
the game.
Can u test this error in non english Monkey Island?
Will next version of scummvm 0.9.1 have any fix to this?

Thanks.

comment:18 Changed 13 years ago by fingolfin

The error does not occur in the german version either. So far the only
reproducible reports we had were for the spanish version of the game.

Since we can't reproduce the issue, we can't "fix" it. Hence 0.9.1 won't contain
a "fix" for it. And in fact it seems likely to be a problem with the data files, not
with ScummVM...

Is this an official LucasArts release of MI, or a fan translation?

comment:19 Changed 13 years ago by SF/therealmaw

ok. i recopy my original german version to the mda. start a
new game. first thing was to grab meat and DONT use with the
stew, then grab flower and use it with the meat.

same error

;(

comment:20 Changed 13 years ago by SF/knakos

1) Try your game on a pc with scummvm 0.9.0 and report if
it crashes too.
2) Provide md5 sums of all files of your MI files

comment:21 Changed 13 years ago by SF/knakos

1) Try your game on a pc with scummvm 0.9.0 and report if
it crashes too.
2) Provide md5 sums of all files of your MI files

comment:22 Changed 13 years ago by SF/therealmaw

1. i crashed on pc too

2.

[Path] / filename MD5 sum
-------------------------------------------------------------------------------
[c:\monkey\]
000.LFL
d0b531227a27c6662018d2bd05aac52a
901.LFL
0d01659586aa770608acc8138daae8cc
902.LFL
838b3d8ed6fa615ae561273ae29efafd
903.LFL
6c72dd66cccae6308f962075c314ee16
904.LFL
87edc5c6d4eb64361df02072e08732ce
DISK01.LEC
f4762f06c3de37d852ff16f093a06406
DISK02.LEC
b74e2034cac3bb3203ee28d4a7d18d4e
DISK03.LEC
b29b164bbd996e18c3387438e5d7a734
DISK04.LEC
a0c2a3b5dadaf6e09ecaa819752aa4a3
MONKEY.EXE
bf345756e26e06453cc761abeae49672
README.VGA
fa7399d3defd9c5b06fd794ee9176cc1

comment:23 Changed 13 years ago by fingolfin

OK, I have the very same version of monkeyvga/german, but still can't
reproduce the issue. We need the *precise* steps you are following now. I did
the following, which failed to trigger a crash under OS X (note that I did
*nothing* else, in particular I didn't pick up other objects etc.; the precise
order is also relevant):

1) start game
2) skip using ESC over the intro etc.
3) walk into the SCUMM bar, enter the kitchen
4) "pick up" the meat from the table.
5) leave the bar, leave the town
6) enter the forest ("Gabelung")
7) Walk through the very first passageway to get to the yellow flowers
8) "pick up" a yellow flower
9) use flower on meat

Is this precisely what you are doing? Or maybe you are doing something in a
different order, or are doing something extra / something less?

comment:24 Changed 13 years ago by SF/therealmaw

yes, this my steps to become the error on pc and mda

comment:25 Changed 13 years ago by fingolfin

Kirben, could you valgrind this?

comment:26 Changed 13 years ago by fingolfin

Owner: changed from SF/knakos to Kirben

comment:27 Changed 13 years ago by Kirben

No problems are reported under Valgrind, when combining
those items. I'm using the English version of Monkey Island
1 (VGA) though.

comment:28 Changed 13 years ago by Kirben

Owner: Kirben deleted

comment:29 Changed 13 years ago by Kirben

I wonder if there is a rare bug somewhere, only triggered
when combining certain items sometimes. As we have had
several similar common bug reports in games, which we have
been unable to reproduce so far.

Monkey Island 1:
Using meat with flower

FOA:
Using ribcage with another item

DOTT:
Using stamp with contract

comment:30 Changed 13 years ago by SF/therealmaw

ok, here a avi snapshot ...
http://www.manatwork.org/video/mi1.avi

good night

comment:31 Changed 13 years ago by fingolfin

Thanks for the video, therealmaw, it confirms that we are doing the precise
same steps. Still doesn't crash for me, though :-/.

Kirben, very good point. My primary suspect is ScummEngine::setOwnerOf in
object.cpp. It's been mostly unchanged since the day it was crated by
strigeus, but it has this code in it with looks very fishy to me:

...
clearOwnerOf(obj);
ss = &vm.slot[_currentScript];
if (ss->where == WIO_INVENTORY && _inventory[ss->number] == obj) {
...

What I consider fishy here is the check
_inventory[ss->number] == obj
which does two odd things:
1) It uses the script number to index the _inventory array, which makes no
sense at all to me
2) It check whether the _inventory array contains "obj" -- but clearOwnerOf()
removed obj from _inventory...

The V4 code definitely differs, but I have no idea what V5-8 ought to do
there... could you compare this to disasm?

comment:32 Changed 13 years ago by fingolfin

In particular, ss->number is 331 in this case, while _numInventory is 80, so
we have an out of bound access.

My guess is that the correct code should check for
ss->number == obj
and that this check was meant to kill the current script if it belongs to the
object we just nuked.

It would be really nice if by fixing this we could finally kill those three long-
standing heisenbugs :-)

comment:33 Changed 13 years ago by Kirben

Our current code for setOwner() seems to match the original
code of SCUMM 5-6 engine, I attached diasm. of setOwner
opcode in DOTT and Monkey Island 2.

Changed 13 years ago by Kirben

Attachment: setOwner.txt added

setOwner disasm.

comment:34 Changed 13 years ago by fingolfin

Owner: set to fingolfin

comment:35 Changed 13 years ago by fingolfin

Indeed, disasm matches (I also just checked the FT
disasm). However, it still makes no sense. Right now I
am pretty much convinced that this is "simply" a long
standing bug in the original SCUMM engine, which they
simply never noticed...

My theory still is that this check is supposed to
detect when an object script nukes its own object, in
which case they try to abort the script early (for
safety, I guess). Normally, this situation should never
occur.

I see at least three possible ways to go about
resolving this:

1) Just remove the check completely. Given that
normally it should never succeed (except by pure random
coincidence), this should be fairly safe, but has a
very small chance of leading to regressions.

2) Keep the check. but do not blindly access
_inventory, rather check whether ss->number <
_numInventory. This way we stay close to the original
while avoiding the OOB access.

3) Implement the check "properly", that is change the
check to "ss->number == obj". However, this is much
more likely to lead to regressions, since scripts that
previously kept running might be stopped now.

My favorite is 1), but what I'll do now is to implement
2), with warnings added to catch the cases relevant for
1) and 3). Tomorrow's daily build should include my
changes, everybody able to reproduce the bug with 0.9.0
please retest then.

comment:36 Changed 13 years ago by fingolfin

This tracker item is pending response by the submitter; we
cannot continue processing it before that happens. As a
consequence, its status has been set to "Pending". It will
automatically revert to "Open" once a new comment is made to
this item. If no response is made within 14 days, it will
automatically be closed.

Thank you.

comment:37 Changed 13 years ago by fingolfin

Status: newpending

comment:38 Changed 13 years ago by SF/therealmaw

hmmm ... i have make another tests with xp and my installed
scummvm 0.9.0 ... now its works - strange o_O ....under ce
crashes every time

mario

comment:39 Changed 13 years ago by SF/gamer_man

Status: pendingnew

comment:40 Changed 13 years ago by SF/gamer_man

response

comment:41 Changed 13 years ago by SF/knakos

No gamer_man, the point fingolfin made was:
1) Test if the bug is reproducible also in the (normal) pc
version of scummvm
2) Test if the bug is reproducible on the latest SVN build
available from the downloads page.
Report your results here.

comment:42 Changed 13 years ago by fingolfin

Status: newpending

comment:43 Changed 13 years ago by SF/gamer_man

Status: pendingnew

comment:44 Changed 13 years ago by SF/gamer_man

OK, sorry.
I'll do it this weekend, because I'm not at home this week.

comment:45 Changed 13 years ago by fingolfin

Status: newpending

comment:46 Changed 13 years ago by fingolfin

Fine, but until that point, this tracker item shall remain in "pending" status :-)

comment:47 Changed 13 years ago by SF/therealmaw

gives a new l8test SVN build for win-ce?

comment:48 Changed 13 years ago by SF/knakos

No, svn builds of the ce port are infrequent and are posted
to the forums for the time being. But the codebase is
obviously shared between all ports, so grab 0.9.0 for the
pc, test your issue and then get the latest svn build, test
it again and report your findings.

comment:49 Changed 13 years ago by SF/gamer_man

Hi again.
I used scummvm version 0.8.2 for WINCE. Started new game,
get the meat, get the yellow petal and use yellow petal
with meat and it works.

I used scummvm version 0.9.0 por PC and same thing. It
works.

I used same game: The Secret of Monkey Island
Spanish/DOS/VGA in all cases, but in version 0.9.0a for
WINCE it crashes.

Any suggestion?

comment:50 Changed 13 years ago by SF/gamer_man

Status: pendingnew

comment:51 Changed 13 years ago by SF/knakos

Owner: changed from fingolfin to SF/knakos

comment:52 Changed 13 years ago by SF/knakos

so, this comes back to me *sigh*. anyway, one more test
(since I can't remember if I updated the codebase between
0.9.0 and 0.9.0a): run this one (it's the wince port):
http://users.uoa.gr/~knakos/scummvm/binaries/scummvm-
0.9.0svn-20060730.bz2

(rename the unbzipped file to include .exe). I hope it's
not optimizer trouble again.

PS. Be aware that since I don't have the means to directly
check the issue, you may be doing a few rounds of testing
for me.

comment:53 Changed 13 years ago by SF/gamer_man

Hi again.
I used scummvm version 0.8.2 for WINCE. Started new game,
get the meat, get the yellow petal and use yellow petal
with meat and it works.

I used scummvm version 0.9.0 por PC and same thing. It
works.

I used same game: The Secret of Monkey Island
Spanish/DOS/VGA in all cases, but in version 0.9.0a for
WINCE it crashes.

Any suggestion?

comment:54 Changed 13 years ago by SF/gamer_man

Owner: changed from SF/knakos to fingolfin
Status: newpending

comment:55 Changed 13 years ago by SF/gamer_man

Hi there.
I tried scummvm-0.9.0svn-20060730. Starting a new game and
using yellow petal whith meat, don't crashes.Then I tried
to do more things before use petal with meat. Never
crashes.

And then I tried to load a game saved with scummvm 0.9.0a
just before use yellow petal whit meat, and this time
don't crash.

Since that, I only use 0.9.0 SVN for WINCE verision.

What's going on with 0.9.0a version?

comment:56 Changed 13 years ago by SF/gamer_man

Status: pendingnew

comment:57 Changed 13 years ago by SF/knakos

I can't say for sure but since 0.9.0 the branch has more of
the good stuff (tm) in it. Fingolfin note that the svn
build is 30 July 2006, if you wat to check on things. Can
we close it now Max?

comment:58 Changed 13 years ago by fingolfin

Resolution: fixed
Status: newclosed

comment:59 Changed 13 years ago by fingolfin

Closing it. I have no idea if the bug really has been fixed (it's simply impossible
to be certain, due to the nature of this (heisen) bug). But I am relatively
confident that I nailed it (and it's siblings) with that fix I made... So let's just
hope I am right :-)

Note: See TracTickets for help on using tickets.