Starship Titanic: asking gossipy DeskBot to continue yields "I don't understand" responses or crashes the game

[CahootsMalone]

General Information

• ScummVM version: 2.2.0 (Sep 14 2020 10:39:25)
• Bug details: please see below
• Language of game: English
• Version of game: GOG release; game files extracted from GOG installer using innoextract
• Operating system: Windows 10 Home, 64-bit, version 20H2, build 19042.1165
• Saved game: please see attached (steps to reproduce below)

Bug Details

After setting the Deskbot's cellpoint settings to their optimal values and asking her about one of the other characters (which results in a response that ends with a line like "I could say more" or "I could go on"), she doesn't elaborate when asked to continue. Also, one way of asking crashes the game.

Expected Behaviour

When asked to continue, the DeskBot should elaborate. For example, when asked about the BellBot, the following exchange should occur:

> what do you think about the BellBot?
Such a nice, young, lampstandy kind of bot . A little unreliable, sometimes, but ... I could say more.
> say more
He just needs a bit of artful sorting out. I could say more...
> say more
His eyes are everywhere. You want to know what's going on, you ask the BellBot. I could go on...
> say more
[DeskBot replies with one of the general gossip-related lines]

Saved Game and Steps to Reproduce

To reproduce the crash, load the attached save game (titanic-win.002; alternatively, visit the sculpture gallery, set the DeskBot's cellpoint settings to their optimal values, and immediately travel to the embarkation lobby) and perform the following steps:

• Click on the DeskBot.
• Enter "What do you think of the BellBot?" (or any other character).
• The DeskBot will reply with appropriate dialogue that ends with "I could say more" or "I could go on".
• Enter "please do".
• The game crashes.

To reproduce the DeskBot's failure to elaborate when asked, load the attached save game and perform these steps instead:

• Click on the DeskBot.
• Enter "What do you think of the BellBot?" (or any other character).
• The DeskBot will reply with appropriate dialogue that ends with "I could say more" or "I could go on".
• Enter "say more" or "go on".
  • "say more" always elicits one of the "I don't understand"-type responses.
  • "go on" elicits a mix of "I don't understand"-type responses and general gossip-related responses (e.g., "No, I mustn't." or "I'm such a dreadful gossip...").

[eriktorbjorn]

I can reproduce this, but only if I compile with optimizations. Without, it doesn't even trigger Valgrind warnings. (I don't want to debug further with Valgrind, because it's horrifyingly slow on my computer, even by Valgrind standards.)

I'm using GCC 10.3 (Debian 10.3.0-10), and it crashes with -O2 but not with -Og. So that's annoying since -Og would be better suited for debugging.

With -O2, I get the following backtrace:

#0  Titanic::TTconcept::findByWordClass(Titanic::WordClass)
    (this=this@entry=0x0, wordClass=wordClass@entry=Titanic::WC_ACTION)
    at engines/titanic/true_talk/tt_concept.cpp:288
#1  0x00005555559cc485 in Titanic::TTparser::considerRequests(Titanic::TTword*)
    (this=this@entry=0x555557206bf0, word=0x55555928acb0)
    at engines/titanic/true_talk/tt_parser.cpp:1000
#2  0x00005555559cd11b in Titanic::TTparser::checkForAction()
    (this=this@entry=0x555557206bf0)
    at engines/titanic/true_talk/tt_parser.cpp:1469
#3  0x00005555559cd72b in Titanic::TTparser::findFrames(Titanic::TTsentence*)
    (this=this@entry=0x555557206bf0, sentence=sentence@entry=0x5555593c86a0)
    at engines/titanic/true_talk/tt_parser.cpp:540
#4  0x00005555559c4a6b in Titanic::CScriptHandler::processInput(Titanic::TTroomScript*, Titanic::TTnpcScript*, Titanic::TTstring const&)
    (this=this@entry=0x555557206be0, roomScript=roomScript@entry=0x55555721f830, npcScript=npcScript@entry=0x55555779edc0, line=...)
    at engines/titanic/true_talk/script_handler.cpp:96
#5  0x0000555555984ad7 in Titanic::CTrueTalkManager::processInput(Titanic::CTrueTalkNPC*, Titanic::CTextInputMsg*, Titanic::CViewItem*)
    (this=0x5555573dea10, npc=npc@entry=0x555556fbda40, msg=0x7fffffffd5a0, 
    msg@entry=0x7fffffffd6e0, view=view@entry=0x555558bd00f0)
    at engines/titanic/true_talk/true_talk_manager.cpp:335
#6  0x0000555555945e94 in Titanic::CTrueTalkNPC::processInput(Titanic::CTextInputMsg*, Titanic::CViewItem*)
    (view=0x555558bd00f0, msg=0x7fffffffd6e0, this=0x555556fbda40)
    at engines/titanic/npcs/true_talk_npc.cpp:236
#7  Titanic::CTrueTalkNPC::TextInputMsg(Titanic::CTextInputMsg*)
    (this=<optimized out>, msg=0x7fffffffd6e0)
    at engines/titanic/npcs/true_talk_npc.cpp:83
#8  0x000055555592f8a9 in Titanic::CMessage::execute(Titanic::CTreeItem*, Titanic::ClassDef const*, int)
    (this=this@entry=0x7fffffffd6e0, target=0x555556fbda40, classDef=classDef@entry=0x0, flags=flags@entry=3) at engines/titanic/messages/messages.cpp:60
#9  0x000055555592f91a in Titanic::CMessage::execute(Titanic::CTreeItem*, Titanic::ClassDef const*, int)
    (this=this@entry=0x7fffffffd6e0, target=<optimized out>, classDef=classDef@entry=0x0, flags=flags@entry=3) at engines/titanic/messages/messages.cpp:49
#10 0x000055555594aaf7 in Titanic::CPetConversations::textLineEntered(Titanic::CString const&) (this=this@entry=0x555558dc8658, textLine=...)
    at engines/titanic/pet_control/pet_conversations.cpp:507
#11 0x000055555594adcc in Titanic::CPetConversations::handleKey(Common::KeyState const&)Python Exception <class 'gdb.error'> Dwarf Error: Cannot find DIE at 0x0 referenced in module /home/d91tan/src/CVS/scummvm-2.3+hack/scummvm: 

    (keyState=#12 Titanic::CPetConversations::KeyCharMsg(Titanic::CKeyCharMsg*)
    (this=0x555558dc8658, msg=<optimized out>)
    at engines/titanic/pet_control/pet_conversations.cpp:224
#13 0x0000555555946d09 in Titanic::CPetControl::KeyCharMsg(Titanic::CKeyCharMsg*) (this=0x555558dc84f0, msg=0x7fffffffd8d0)
    at engines/titanic/pet_control/pet_control.cpp:339
#14 0x000055555592f8a9 in Titanic::CMessage::execute(Titanic::CTreeItem*, Titanic::ClassDef const*, int)
    (this=this@entry=0x7fffffffd8d0, target=0x555558dc84f0, classDef=classDef@entry=0x0, flags=flags@entry=2) at engines/titanic/messages/messages.cpp:60
#15 0x000055555592f91a in Titanic::CMessage::execute(Titanic::CTreeItem*, Titanic::ClassDef const*, int)
    (this=this@entry=0x7fffffffd8d0, target=<optimized out>, classDef=classDef@entry=0x0, flags=flags@entry=2) at engines/titanic/messages/messages.cpp:49
#16 0x0000555555991ac2 in Titanic::CInputHandler::dispatchMessage(Titanic::CMessage*) (this=0x5555573ed1b0, msg=0x7fffffffd8d0)
    at engines/titanic/input_handler.cpp:154
#17 0x0000555555991c73 in Titanic::CInputHandler::processMessage(Titanic::CMessage*) (this=0x5555573ed1b0, msg=0x7fffffffd8d0)
    at engines/titanic/input_handler.cpp:84
#18 0x0000555555991f8d in Titanic::CInputHandler::handleMessage(Titanic::CMessage&, bool) (this=<optimized out>, msg=..., respectLock=respectLock@entry=true)
    at engines/titanic/input_handler.cpp:72
#19 0x00005555559923c8 in Titanic::CInputTranslator::keyDown(Common::KeyState const&) (this=0x5555573ed1e0, keyState=...)
    at engines/titanic/input_translator.cpp:91
#20 0x0000555555992565 in Titanic::CMainGameWindow::keyDown(Common::KeyState) (this=0x555557a278f0, keyState=...)
    at engines/titanic/main_game_window.cpp:363
#21 0x000055555598f1d8 in Titanic::Events::pollEvents() (this=0x555557773dc0)
    at engines/titanic/events.cpp:95
#22 0x000055555598f3bd in Titanic::Events::pollEventsAndWait()
    (this=<optimized out>) at engines/titanic/events.cpp:112
#23 0x00005555558aab6c in Titanic::TitanicEngine::run() (this=0x555557640760)
    at engines/titanic/titanic.cpp:146
#24 0x000055555588def7 in runGame(Plugin const*, Plugin const*, OSystem&, Common::String const&)
    (plugin=plugin@entry=0x555556465000, enginePlugin=0x7fffffffdc38, 
    enginePlugin@entry=0x5555566a0ab0, system=..., debugLevels=...)
    at base/main.cpp:311
#25 0x00005555558903a5 in scummvm_main(int, char const* const*)
    (argc=<optimized out>, argv=<optimized out>) at base/main.cpp:616
#26 0x0000555555835104 in main(int, char**) (argc=1, argv=0x7fffffffe638)
    at backends/platform/sdl/posix/posix-main.cpp:45

(Yes, the backtrace really did triger some Python exception. Oh well, hopefully it's reliable enough.)

Apparently, _conceptP was NULL when considerRequests() tried to call findByWordClass() in it.

[eriktorbjorn]

It adds a concept, then removes it again. At first I thought the unoptimized version removed a different concept, but when I tried again that wasn't the case.

I don't understand this engine, but I think the concept it's adding is based on the word "bellbot".

The removeConcept() function is called from filterConcepts().

I think this is as far as I'm getting on my own.

[eriktorbjorn]

Huh? The only difference I've seen so far between optimized and unoptimized is that for some insane reason, the unoptimized one didn't crash when considerRequests() calls _conceptP->findWordByClass(WC_ACTION) while _conceptP is NULL.

What dark sorcery is this?! I mean, I guess the behavior is undefined but come on!

[antoniou79]

I've just written a similar observation in the other ticket here:
https://bugs.scummvm.org/ticket/12950

Seems that this is the same issue.

And indeed I compiled in msys2 with optimizations, so I got the segmentation fault, while I debugged on Visual Studio with (no optimizations) and findWordByClass() would return nullptr when called for a null object (_conceptP).

[dreammaster]

This should now be fixed.