GUI: Segmentation fault when clicking on Options in the ScummVM GMM

[antoniou79]

Edit: This actually seems to be a more general regression, since the bug occurs when clicking on Options on the ScummVM GMM (in-game), regardless of the game engine.

This happens on a local build 2.6.0git from master and on the recent daily on Windows 10 x64 (windows-x86-64-master-87b7ddc7).

Original steps to reproduce (first noticed while testing Ultima 8):
This is with Ultima 8 Gold Edition/DOS/English (GOG release).

The bug does not happen in ScummVM 2.2.0 or in 2.5.0 stable releases. It seems to be a regression.

Steps to reproduce.

1. Launch Ultima 8
2. Start a new game, give a name to your avatar and reach the first gameplay screen.
3. Press Esc to bring up the in-game native menu.
4. Choose "4. Options".

Bug Result: The game either freezes or exits with a segmentation fault.
Expected result: This options should bring up the ScummVM GMM options menu (this is how it works in 2.5.0 and 2.2.0).

[einstein95]

Backtrace

#0  0x000055555872d795 in GUI::Widget::setEnabled(bool) (this=0x0, e=false) at ../gui/widget.cpp:195
#1  0x00005555586e5b45 in GUI::OptionsDialog::setGraphicSettingsState(bool) (this=0x7fffffffcd50, enabled=false) at ../gui/options.cpp:1075
#2  0x00005555586ee376 in GUI::OptionsDialog::setupGraphicsTab() (this=0x7fffffffcd50) at ../gui/options.cpp:1811
#3  0x00005555586ee332 in GUI::OptionsDialog::reflowLayout() (this=0x7fffffffcd50) at ../gui/options.cpp:1807
#4  0x00005555586d4840 in GUI::GuiManager::openDialog(GUI::Dialog*) (this=0x55555c9efe60, dialog=0x7fffffffcd50)
    at ../gui/gui-manager.cpp:558
#5  0x00005555586d0450 in GUI::Dialog::open() (this=0x7fffffffcd50) at ../gui/dialog.cpp:88
#6  0x00005555586e1999 in GUI::OptionsDialog::open() (this=0x7fffffffcd50) at ../gui/options.cpp:558
#7  0x00005555586d0403 in GUI::Dialog::runModal() (this=0x7fffffffcd50) at ../gui/dialog.cpp:76
#8  0x00005555581fb6d5 in Ultima::Ultima8::Ultima8Engine::openConfigDialog() (this=0x55555ce9d530)
    at ../engines/ultima/ultima8/ultima8.cpp:1273
#9  0x00005555582404e0 in Ultima::Ultima8::MenuGump::selectEntry(int) (this=0x55555d8497e0, entry=4)
    at ../engines/ultima/ultima8/gumps/menu_gump.cpp:235
#10 0x000055555824036e in Ultima::Ultima8::MenuGump::ChildNotify(Ultima::Ultima8::Gump*, unsigned int)
    (this=0x55555d8497e0, child=0x55555d86b130, message=0) at ../engines/ultima/ultima8/gumps/menu_gump.cpp:218
#11 0x000055555824ea3a in Ultima::Ultima8::ButtonWidget::onMouseClick(int, int, int) (this=0x55555d86b130, button=1, mx=205, my=63)
    at ../engines/ultima/ultima8/gumps/widgets/button_widget.cpp:146
#12 0x0000555558255bcb in Ultima::Ultima8::Mouse::handleDelayedEvents() (this=0x55555ccbbd60)
    at ../engines/ultima/ultima8/kernel/mouse.cpp:524
#13 0x00005555581f9733 in Ultima::Ultima8::Ultima8Engine::handleDelayedEvents() (this=0x55555ce9d530)
    at ../engines/ultima/ultima8/ultima8.cpp:858
#14 0x00005555581f81c8 in Ultima::Ultima8::Ultima8Engine::runGame() (this=0x55555ce9d530) at ../engines/ultima/ultima8/ultima8.cpp:584
#15 0x00005555581f5bb6 in Ultima::Ultima8::Ultima8Engine::run() (this=0x55555ce9d530) at ../engines/ultima/ultima8/ultima8.cpp:163
#16 0x0000555555ccef37 in runGame(Plugin const*, Plugin const*, OSystem&, Common::String const&)
    (plugin=0x55555aab3e80, enginePlugin=0x55555a9c1ae0, system=..., debugLevels=...) at ../base/main.cpp:318
#17 0x0000555555cd08b3 in scummvm_main(int, char const* const*) (argc=3, argv=0x7fffffffde58) at ../base/main.cpp:626
#18 0x0000555555ccc17c in main(int, char**) (argc=3, argv=0x7fffffffde58) at ../backends/platform/sdl/posix/posix-main.cpp:45

[antoniou79]

It turns out the issue was not specific to Ultima 8, but to "Options" from the in-game ScummVM GMM menu, regardless of the game engine.

I've committed a fix for this:
​https://github.com/scummvm/scummvm/commit/56ef67f6d5f3e68a976a7ac22a37c34a1c463dee

Probably we should cherry-pick it for 2.5.1, if we also cherry-pick the related previous commit (​https://github.com/scummvm/scummvm/commit/c40b2bf1254e750f51deb28085eaf32fec2aba70)

[tag2015]

Did the commit fix the issue? I never experienced these segfaults using recent builds (with "recent" I mean newer than 2.6.0).

[antoniou79]

The issue is fixed for me as well. I think I kept this open in order to have a reminder to cherry-pick for 2.5.1 (which I believe we did not).

The fix is now part of 2.6.0 and 2.6.1 so the ticket can be closed.