[Scummvm-tracker] [ScummVM :: Bugs] #15420: DREAMWEB: crash due to failed assertion in DreamWebEngine::deleteExFrame

[ScummVM :: Bugs]

#15420: DREAMWEB: crash due to failed assertion in DreamWebEngine::deleteExFrame
---------------------+------------------------------
Reporter:  huntekye  |      Owner:  (none)
    Type:  defect    |     Status:  new
Priority:  normal    |  Component:  Engine: Dreamweb
 Version:            |   Keywords:
    Game:  Dreamweb  |
---------------------+------------------------------
 Version:
 I encountered this issue first on ScummVM 2.8.1, and then built it from
 git with no change to the outcome.

 For me the problem occurs at a specific point in the game, at which point
 the game crashes.
 To reproduce:
 I installed DreamWeb on Arch using the package manager `yay`, and
 confirmed that the bug occurs using both Sway (Wayland) and i3 (X11). In
 the game, while trying to leave the DreamWeb after killing General
 Stirling, Ryan uses to key to be transported back to Spark's bar, but at
 the moment that it seems the scene should change, instead the game
 crashes. Below is the full output I get from the `dreamweb` process:
 {{{
 $ scummvm -v
 ScummVM 2.8.1 (Mar 16 2024 08:27:46)
 Using SDL backend with SDL 2.30.8
 Features compiled in: TAINTED Vorbis FLAC MP3 ALSA SEQ sndio TiMidity RGB
 zLib MPEG2 FluidSynth Theora AAC A/52 FreeType2 FriBiDi JPEG PNG GIF TTS
 cloud (servers, local) ENet SDL2 TinyGL OpenGL (with shaders)
 $ dreamweb
 WARNING: Couldn't initialize text to speech through speech-dispatcher!
 User picked target 'dreamweb' (engine ID 'dreamweb', game ID
 'dreamweb')...
    Looking for a plugin supporting this target... DreamWeb
 Running DreamWeb (CD/DOS/English)
 dreamweb.r00: 3b5c87717fc40cc5a5ae19c155662ee3, 152918 bytes.
 dreamweb.r02: d6fe5e3590ec1eea42ff65c10b023e0f, 198681 bytes.
 WARNING: Unknown scaler; defaulting to 1!
 scummvm: engines/dreamweb/object.cpp:448: void
 DreamWeb::DreamWebEngine::deleteExFrame(uint8): Assertion `frame->ptr() +
 frame->width*frame->height <= _vars._exFramePos' failed.
 /usr/bin/dreamweb: line 3: 37666 Aborted                 (core dumped)
 scummvm "$@" -f -p /usr/share/dreamweb dreamweb
 }}}
 And again with the git version of ScummVM:
 {{{
 $ scummvm -v
 ScummVM 2.9.0git (Oct 24 2024 20:23:21)
 Using SDL backend with SDL 2.30.8
 Features compiled in: TAINTED Vorbis FLAC MP3 ALSA SEQ sndio TiMidity RGB
 zLib MPEG2 FluidSynth OpenMPT Theora VPX AAC A/52 FreeType2 FriBiDi JPEG
 PNG GIF TTS cloud (servers, local) ENet SDL2 TinyGL OpenGL (with shaders)
 $ dreamweb
 WARNING: DebugManager::addDebugChannels(): No debug channels were added,
 list is empty!
 WARNING: DebugManager::addDebugChannels(): No debug channels were added,
 list is empty!
 WARNING: Couldn't initialize text to speech through speech-dispatcher!
 User picked target 'dreamweb' (engine ID 'dreamweb', game ID
 'dreamweb')...
 Running DreamWeb (CD/DOS/English)
 dreamweb.r00: 3b5c87717fc40cc5a5ae19c155662ee3, 152918 bytes.
 dreamweb.r02: d6fe5e3590ec1eea42ff65c10b023e0f, 198681 bytes.
 WARNING: Unknown scaler; defaulting to 1!
 scummvm: engines/dreamweb/object.cpp:448: void
 DreamWeb::DreamWebEngine::deleteExFrame(uint8): Assertion `frame->ptr() +
 frame->width*frame->height <= _vars._exFramePos' failed.
 /usr/bin/dreamweb: line 3: 124674 Aborted                 (core dumped)
 scummvm "$@" -f -p /usr/share/dreamweb dreamweb
 }}}

 Where the last two lines seem to describe that
 [https://github.com/scummvm/scummvm/blob/672cb6565ac817ea38bbbf9cf1cea9f38463c0d4/engines/dreamweb/object.cpp#L448
 this] assertion failed. It's unclear to me exactly what a `frame` is in
 this context, but on the chance that this is related to the size of the
 screen/window, the following information might be helpful: Since I'm
 running on a MacBook Pro 14,1, the resolution is fairly high, 2560x1600,
 and although I usually run with Sway with the output scaled to 1.5, I
 checked that the problem is the same with the nominal scaling as well.
 I've attached a save file, `DREAMWEB.D01`, at the correct point in the
 game, so one should simply have to load the game, walk to the plinth, use
 the key on it, and wait a few moments for the game to crash.

 Game language:
 English.

 Game Version:
 DreamWeb was downloaded from [http://downloads.sourceforge.net/scummvm
 /dreamweb-cd-uk-1.1.zip], and when run it seems to report its version as
 `Running DreamWeb (CD/DOS/English)`.

 My system:
 {{{
 $ neofetch --off
 OS: Arch Linux x86_64
 Host: MacBookPro14,1 1.0
 Kernel: 6.9.7-arch1-1
 Uptime: 4 hours, 30 mins
 Packages: 1552 (pacman)
 Shell: bash 5.2.37
 Resolution: 2560x1600
 WM: sway
 Theme: Arc-Dark [GTK2/3]
 Icons: Arc [GTK2/3]
 Terminal: terminator
 CPU: Intel i5-7360U (4) @ 3.600GHz
 GPU: Intel Iris Plus Graphics 640
 Memory: 6485MiB / 15860MiB
 }}}

 Save game:
 Attached; `DREAMWEB.D01`
-- 
Ticket URL: <https://bugs.scummvm.org/ticket/15420>
ScummVM :: Bugs <https://bugs.scummvm.org>
ScummVM