SCUMM: MONKEY2 (MAC): segfault when typing 'rough' right at the start of the game

[dwatteau]

Current Git HEAD, built with --enable-asan. Playing the Macintosh release of Monkey Island 2, as part of the Monkey Island Anthology set from LRG.

Steps are as follows:

1. Start a new game
2. In the difficulty selection screen, or when Guybrush appears right before Elaine comes to rescue him, type rough on the keyboard (to disable the smooth graphics option)

The game immediately crashes, with the following ASAN trace:

User picked target 'monkey2-mac' (engine ID 'scumm', game ID 'monkey2')...
AddressSanitizer:DEADLYSIGNAL
=================================================================
==37435==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000022 (pc 0x000104365a06 bp 0x7ff7bbef45a0 sp 0x7ff7bbef3ce0 T0)
==37435==The signal is caused by a READ memory access.
==37435==Hint: address points to the zero page.
    #0 0x104365a06 in Scumm::MacGuiImpl::MacDialogWindow::MacDialogWindow(Scumm::MacGuiImpl*, OSystem*, Graphics::Surface*, Common::Rect, Scumm::MacGuiImpl::MacDialogWindowStyle, Scumm::MacGuiImpl::MacDialogMenuStyle) macgui_dialogwindow.cpp:46
    #1 0x104368828 in Scumm::MacGuiImpl::MacDialogWindow::MacDialogWindow(Scumm::MacGuiImpl*, OSystem*, Graphics::Surface*, Common::Rect, Scumm::MacGuiImpl::MacDialogWindowStyle, Scumm::MacGuiImpl::MacDialogMenuStyle) macgui_dialogwindow.cpp:42
    #2 0x104383368 in Scumm::MacGuiImpl::createWindow(Common::Rect, Scumm::MacGuiImpl::MacDialogWindowStyle, Scumm::MacGuiImpl::MacDialogMenuStyle) macgui_impl.cpp:628
    #3 0x104384553 in Scumm::MacGuiImpl::createDialog(int) macgui_impl.cpp:681
    #4 0x10438a90a in Scumm::MacGuiImpl::runOkCancelDialog(Common::String) macgui_impl.cpp:949
    #5 0x1043e4752 in Scumm::MacV5Gui::handleEvent(Common::Event) macgui_v5.cpp:952
    #6 0x104364779 in Scumm::MacGui::handleEvent(Common::Event) macgui.cpp:84
    #7 0x104345a53 in Scumm::ScummEngine::parseEvent(Common::Event) input.cpp:115
    #8 0x104349ee9 in Scumm::ScummEngine::parseEvents() input.cpp:357
    #9 0x1046a1c86 in Scumm::ScummEngine::waitForTimer(int, bool) scumm.cpp:2632
    #10 0x1046a152b in Scumm::ScummEngine::go() scumm.cpp:2589
    #11 0x10418444d in Scumm::ScummEngine::run() scumm.h:585
    #12 0x10405062f in runGame(Plugin const*, OSystem&, DetectedGame const&, void const*) main.cpp:311
    #13 0x10404a0b0 in scummvm_main main.cpp:796
    #14 0x104037ea2 in main macosx-main.cpp:44
    #15 0x7ff800920417 in start+0x767 (dyld:x86_64+0xfffffffffff6e417)

==37435==Register values:
rax = 0x0000000000000022  rbx = 0x00007ff7bbef3ea0  rcx = 0x0000100000000000  rdx = 0x00006150001efd00  
rdi = 0x000061900031f180  rsi = 0x00007ff7bbef3d00  rbp = 0x00007ff7bbef45a0  rsp = 0x00007ff7bbef3ce0  
 r8 = 0x01aa00d600560080   r9 = 0x0000000000000000  r10 = 0x01aa00d600560080  r11 = 0xffffe118442ba70a  
r12 = 0x00007ff7bbefb918  r13 = 0x00007ff7bbefb990  r14 = 0x00007ff7bbefb950  r15 = 0x00007ff7bbefb7e0  
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV macgui_dialogwindow.cpp:46 in Scumm::MacGuiImpl::MacDialogWindow::MacDialogWindow(Scumm::MacGuiImpl*, OSystem*, Graphics::Surface*, Common::Rect, Scumm::MacGuiImpl::MacDialogWindowStyle, Scumm::MacGuiImpl::MacDialogMenuStyle)
==37435==ABORTING
Abort trap: 6

LLDB trace attached below.

[dwatteau]

LLDB trace when the crash happens

[eriktorbjorn]

Valgrind doesn't show any errors here, so I'm not sure what's going on.