[Scummvm-tracker] [ScummVM :: Bugs] #13512: AGS: Segfault on quitting a game

[ScummVM :: Bugs]

#13512: AGS: Segfault on quitting a game
-------------------------+--------------------------
Reporter:  eriktorbjorn  |       Owner:  (none)
    Type:  defect        |      Status:  new
Priority:  high          |   Component:  Engine: AGS
 Version:                |  Resolution:
Keywords:                |        Game:
-------------------------+--------------------------
Comment (by criezy):

 I can indeed reproduce the crash with all the games I tried. This is
 likely a recent regression introduced when applying the upstream commits
 as all the games I tried used to quit properly.

 Address Sanitizer reports the same issue as valgrind:
 {{{
 WRITE of size 4 at 0x00011bbafd98 thread T0
     #0 0x103addd58 in AGS3::ScriptViewport::Invalidate()
 script_viewport.h:42
     #1 0x103aeedc4 in AGS3::GameState::FreeViewportsAndCameras()
 game_state.cpp:822
     #2 0x103ab53e8 in AGS3::unload_game_file() game.cpp:362
     #3 0x103d546c4 in AGS3::quit_release_data() quit.cpp:153
     #4 0x103d55038 in AGS3::quit_free() quit.cpp:230
     #5 0x10381aff0 in AGS::AGSEngine::run() ags.cpp:198
     #6 0x102e12678 in runGame(Plugin const*, Plugin const*, OSystem&,
 Common::String const&) main.cpp:318
     #7 0x102e0e0d4 in scummvm_main main.cpp:619
     #8 0x102e0480c in main macosx-main.cpp:44
     #9 0x1a2b7942c in start+0x0 (libdyld.dylib:arm64e+0x1842c)

 0x00011bbafd98 is located 8 bytes inside of 16-byte region
 [0x00011bbafd90,0x00011bbafda0)
 freed by thread T0 here:
     #0 0x11774aacc in wrap__ZdlPv+0x74
 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4aacc)
     #1 0x103c807e0 in AGS3::ScriptViewport::Dispose(char const*, bool)
 script_viewport.cpp:42
     #2 0x103c729b0 in
 AGS3::ManagedObjectPool::Remove(AGS3::ManagedObjectPool::ManagedObject&,
 bool) managed_object_pool.cpp:46
     #3 0x103c76ed8 in AGS3::ManagedObjectPool::reset()
 managed_object_pool.cpp:364
     #4 0x103c702ec in AGS3::ccUnregisterAllObjects()
 cc_dynamic_object.cpp:76
     #5 0x103d53a78 in AGS3::quit_shutdown_scripts() quit.cpp:76
     #6 0x103d54cd4 in AGS3::quit_free() quit.cpp:204
     #7 0x10381aff0 in AGS::AGSEngine::run() ags.cpp:198
     #8 0x102e12678 in runGame(Plugin const*, Plugin const*, OSystem&,
 Common::String const&) main.cpp:318
     #9 0x102e0e0d4 in scummvm_main main.cpp:619
     #10 0x102e0480c in main macosx-main.cpp:44
     #11 0x1a2b7942c in start+0x0 (libdyld.dylib:arm64e+0x1842c)

 previously allocated by thread T0 here:
     #0 0x11774a6b4 in wrap__Znwm+0x74
 (libclang_rt.asan_osx_dynamic.dylib:arm64e+0x4a6b4)
     #1 0x103adc7f8 in AGS3::GameState::CreateRoomViewport()
 game_state.cpp:245
     #2 0x103adc3a8 in AGS3::GameState::CreatePrimaryViewportAndCamera()
 game_state.cpp:229
     #3 0x103c97570 in
 AGS3::AGS::Engine::InitAndRegisterGameEntities(AGS3::GameSetupStruct&)
 game_init.cpp:250
     #4 0x103c9a2d4 in
 AGS3::AGS::Engine::InitGameState(AGS3::AGS::Shared::LoadedGameEntities
 const&, AGS3::GameDataVersion) game_init.cpp:383
     #5 0x103d312e4 in AGS3::load_game_file() game_file.cpp:197
     #6 0x103d167bc in AGS3::engine_load_game_data() engine.cpp:378
     #7 0x103d24620 in
 AGS3::initialize_engine(AGS3::std::map<AGS3::AGS::Shared::String,
 AGS3::std::map<AGS3::AGS::Shared::String, AGS3::AGS::Shared::String,
 Common::Less<AGS3::AGS::Shared::String> >,
 Common::Less<AGS3::AGS::Shared::String> > const&) engine.cpp:1147
     #8 0x10381afec in AGS::AGSEngine::run() ags.cpp:195
 }}}
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/13512#comment:2>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM