[Scummvm-tracker] [ScummVM :: Bugs] #15516: GOB: Adibou 2 (Demo): random setGoblinState() SIGSEGV at game start

[ScummVM :: Bugs]

#15516: GOB: Adibou 2 (Demo): random setGoblinState() SIGSEGV at game start
---------------------+-------------------------
Reporter:  dwatteau  |      Owner:  (none)
    Type:  defect    |     Status:  new
Priority:  normal    |  Component:  Engine: Gob
 Version:            |   Keywords:
    Game:  Adibou 2  |
---------------------+-------------------------
 Current Git HEAD, with the Adibou 2 French demo (adibou2-demo-win-fr) at:
 <https://downloads.scummvm.org/frs/demos/gob/adibou2-dos-demo-fr.zip>

 The crash appears around 1 time out of 5, when starting a new game.

 In order to trigger it:

 1. Start a new game of the demo above
 2. Create a new character (or load an exiting character; I've attached
 mine below)
 3. Wait for a new game to start

 In the first few seconds of the game (e.g. when there's the visual effect
 gradually showing Adibou's world, or when Adibou appears on screen and
 everyone dances a bit), a SIGSEGV can randomly happen.

 Here's a quick summary of the crash in GDB:

 {{{
 Program received signal SIGSEGV, Segmentation fault.
 0x112c40c0 in Gob::Goblin_v7::setGoblinState (this=0x16d75328,
 obj=0x16da942a, animState=5791) at engines/gob/goblin_v7.cpp:79
 79                              if (animVariablesForState[0] == 0) {

 (gdb) p animVariablesForState
 $1 = (int16 *) 0x17a996a4
 (gdb) p *animVariablesForState
 Cannot access memory at address 0x17a996a4

 (gdb) bt
 #0  0x112c40c0 in Gob::Goblin_v7::setGoblinState (this=0x16d75328,
 obj=0x16da942a, animState=5791) at engines/gob/goblin_v7.cpp:79
 #1  0x113026ec in Gob::Inter_v7::o7_setGoblinState (this=0x16d038d8) at
 engines/gob/inter_v7.cpp:324
 #2  0x1130bd0c in Common::Functor0Mem<void, Gob::Inter_v7>::operator()
 (this=0x16bbaa28) at ./common/func.h:397
 #3  0x112c7bcc in Gob::Inter::executeOpcodeDraw (this=0x16d038d8, i=85
 'U') at engines/gob/inter.cpp:80
 #4  0x112d5b00 in Gob::Inter_v1::o1_drawOperations (this=0x16d038d8,
 params=...) at engines/gob/inter_v1.cpp:1420
 #5  0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void,
 Gob::Inter_v1>::operator() (this=0x16ca2188, v1=...) at
 ./common/func.h:460
 #6  0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=1
 '\001', j=14 '\016', params=...) at engines/gob/inter.cpp:91
 #7  0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=2) at
 engines/gob/inter.cpp:323
 #8  0x112c93a0 in Gob::Inter::callSub (this=0x16d038d8, retFlag=2) at
 engines/gob/inter.cpp:352
 #9  0x112d260c in Gob::Inter_v1::o1_callSub (this=0x16d038d8, params=...)
 at engines/gob/inter_v1.cpp:730
 #10 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void,
 Gob::Inter_v1>::operator() (this=0x16db8468, v1=...) at
 ./common/func.h:460
 #11 0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=0
 '\000', j=0 '\000', params=...) at engines/gob/inter.cpp:91
 #12 0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=0) at
 engines/gob/inter.cpp:323
 #13 0x112d3668 in Gob::Inter_v1::o1_if (this=0x16d038d8, params=...) at
 engines/gob/inter_v1.cpp:929
 #14 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void,
 Gob::Inter_v1>::operator() (this=0x16c8a860, v1=...) at
 ./common/func.h:460
 #15 0x112c7e04 in Gob::Inter::executeOpcodeFunc (this=0x16d038d8, i=0
 '\000', j=8 '\b', params=...) at engines/gob/inter.cpp:91
 #16 0x112c91bc in Gob::Inter::funcBlock (this=0x16d038d8, retFlag=2) at
 engines/gob/inter.cpp:323
 #17 0x112c93a0 in Gob::Inter::callSub (this=0x16d038d8, retFlag=2) at
 engines/gob/inter.cpp:352
 #18 0x112d260c in Gob::Inter_v1::o1_callSub (this=0x16d038d8, params=...)
 at engines/gob/inter_v1.cpp:730
 #19 0x112dfb80 in Common::Functor1Mem<Gob::OpFuncParams&, void,
 Gob::Inter_v1>::operator() (this=0x16db8468, v1=...) at
 ./common/func.h:460

 [cut]
 }}}

 Fuller, much longer GDB trace attached below.
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/15516>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM