Opened 13 years ago

Closed 13 years ago

Last modified 13 years ago

#5911 closed defect (fixed)

BASS: Crash when using GMM and control panel

Reported by: wjp Owned by: digitall
Priority: normal Component: Engine: Sky
Version: Keywords:
Cc: Game: Beneath a Steel Sky

Description

When opening the GMM with Ctrl-F5 while the regular F5 menu is open, you can load a game. Doing so will instantly crash scummvm.

(Current git, Linux)

Ticket imported from: #3448294. Ticket imported from: bugs/5911.

Change History (5)

comment:1 by wjp, 13 years ago

Loading while the screen is scrolling also has interesting effects.

comment:2 by digitall, 13 years ago

Replicated crash, reran with Valgrind. This is due to accessing freed memory. Relevant trace follows: ==18141== Invalid read of size 2 ==18141== at 0x80D40BA: Sky::ConResource::isMouseOver(unsigned int, unsigned int) (control.cpp:61) ==18141== by 0x80D689A: Sky::Control::doControlPanel() (control.cpp:490) ==18141== by 0x80CDCB8: Sky::SkyEngine::handleKey() (sky.cpp:145) ==18141== by 0x80CE0EB: Sky::SkyEngine::go() (sky.cpp:211) ==18141== by 0x80CF28E: Sky::SkyEngine::run() (sky.h:108) ==18141== by 0x804F708: runGame(PluginSubclass<MetaEngine> const*, OSystem&, Common::String const&) (main.cpp:210) ==18141== by 0x8050322: scummvm_main (main.cpp:423) ==18141== by 0x804E582: main (posix-main.cpp:45) ==18141== Address 0x6927ee0 is 16 bytes inside a block of size 36 free'd ==18141== at 0x40252EC: operator delete(void*) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==18141== by 0x80DAB45: Sky::ConResource::~ConResource() (control.h:138) ==18141== by 0x80D4D64: Sky::Control::removePanel() (control.cpp:227) ==18141== by 0x80DA65E: Sky::Control::quickXRestore(unsigned short) (control.cpp:1461) ==18141== by 0x80CD21D: Sky::SkyEngine::loadGameState(int) (detection.cpp:279) ==18141== by 0x8150810: Engine::openMainMenuDialog() (engine.cpp:426) ==18141== by 0x81320AD: DefaultEventManager::pollEvent(Common::Event&) (default-events.cpp:127) ==18141== by 0x80DA88D: Sky::Control::delay(unsigned int) (control.cpp:1490) ==18141== by 0x80D6827: Sky::Control::doControlPanel() (control.cpp:482) ==18141== by 0x80CDCB8: Sky::SkyEngine::handleKey() (sky.cpp:145) ==18141== by 0x80CE0EB: Sky::SkyEngine::go() (sky.cpp:211) ==18141== by 0x80CF28E: Sky::SkyEngine::run() (sky.h:108) ==18141==

Many similar invalid accesses occur and outside of Valgrind, cause a segfault...

comment:3 by digitall, 13 years ago

According to fuzzie: The problem is that doControlPanel() doesn't disable save/load and yet assumes that a game won't get loaded from underneath it..

comment:4 by digitall, 13 years ago

This bug was fixed by commit 2fe60082e87ecc2c2d2f433f73e7c70e988e90d0 from Eric Culp, one of our GSoC applicants. Closing.

comment:5 by digitall, 13 years ago

Owner: set to digitall
Resolution: fixed
Status: newclosed
Note: See TracTickets for help on using tickets.