Opened 7 years ago

Closed 7 years ago

#9880 closed defect (fixed)

TITANIC: Starship Titanic: Deskbot crash on return respond

Reported by: dafioram Owned by: dreammaster
Priority: high Component: Engine: Titanic
Version: Keywords:
Cc: Game: Starship Titanic

Description

ScummVM: 1.10.0git-3571-gd5ebd9a 64bit
Game: Starship Titanic, GOG (1.00.42c), Windows/English
Tester OS: Win7-64

After talking to the deskbot and then the bellbot if I talk to her again and say anything except "help" the game hard crashes. No error message. There may be some more responses that don't crash.

Attachments (1)

titanic-win.004 (107.7 KB ) - added by dafioram 7 years ago.
save after talking to desk and bellbot just talk to deskbot again and say something besides help

Download all attachments as: .zip

Change History (8)

by dafioram, 7 years ago

Attachment: titanic-win.004 added

save after talking to desk and bellbot just talk to deskbot again and say something besides help

comment:1 by dreammaster, 7 years ago

Owner: set to dreammaster
Summary: Titanic: Starship Titanic: Deskbot crash on return respondTITANIC: Starship Titanic: Deskbot crash on return respond

Hmm.. I'm having trouble replicating the problem, even using your savegame. What's specific examples of stuff you entered that crashed?

comment:2 by dafioram, 7 years ago

I bet you'r not using windows.

See the video here: http://sendvid.com/3s9t0qos

comment:3 by dreammaster, 7 years ago

Resolution: fixed
Status: newclosed

I am actually. Maybe it was because I'm using a Visual Studio development environment rather than a daily build. In any case, I was able to replicate a crash using "upgrade my room", which I've fixed. So hopefully this will have fixed the crash you experienced as well.

comment:4 by dafioram, 7 years ago

Resolution: fixed
Status: closednew

This crash is still present 1.10.0git-3766-gb0ecbc9 (July 10) even if I say "upgrade my room". Are you using the GOG versions?

I started from the beginning of the game and didn't use a previous saved game.

comment:5 by wjp, 7 years ago

The problem might be that TTquotesTree::search seems to expect its TTtreeResult *buffer to be a buffer of multiple TTtreeResult objects. (Since search1 happily access buffer + 1 and further by recursing.)

DeskbotScript::searchQuotes() calls it with only a single TTtreeResult object.

Other functions seem to call it with a similar pattern.

Valgrind points at two more suspicious things here, although I suspect the one above is the actual culprit: CWaveFile::audioStream tells the MemoryReadStream to dispose of _waveData at end with free, even though it is allocated with new[]. And TTparser::filterConcepts accesses deleted data when doing currP = currP->_nextP after deleting currP in removeConcept(currP).

comment:6 by dreammaster, 7 years ago

I've fixed the bugs that wjp helpfully pointed out. If you could test on tomorrow's daily build, and see if it fixes the crash. Thanks.

comment:7 by dreammaster, 7 years ago

Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.