NUVIE: Fix Ultima 6 crash on FM-Towns sound load #4931
Conversation
|
Could you provide a bit more info on what execution path causes the crash, and potential explain why this does not occur on debug builds but occurs on release/optimizations-enabled builds? Also, personally I'd suggest that this is fixed in a less obscure way. Perhaps by explicitly calling close() or whatever clears up allocated memory so that there won't be rogue access to it and/or adding checks for null and (maybe) updating the relevant destructors to avoid such access. |
PushmePullyu
force-pushed
the
fix-u6-fmtowns-crash
branch
from
02674ff to
0fcf08c
Compare
U6Lib_n::close(): Do not call close() on NuvieIO buffers passed to us
via U6Lib_n::open(). Let the caller handle this instead.
Prevents a crash caused by the following events:
- The game detects the files of the FM-Towns version
("townsu6" in the game directory) and eventually attempts to load
"sounds1.dat" in TownsSfxManager::loadSound1Dat()
- Here, it creates local objects U6Lib_n "lib" and NuvieIOBuffer "iobuf"
- File data is loaded into "iobuf", which is then passed to "lib" via
pointer. This pointer is stored by "lib"
- When TownsSfxManager::loadSound1Dat() returns, "iobuf" goes out of
scope and is destroyed before "lib"
- The destructor of "lib" tries to call close() via the stale pointer,
thus causing the crash
Fixes #14429
PushmePullyu
force-pushed
the
fix-u6-fmtowns-crash
branch
from
0fcf08c to
5df68c9
Compare
|
Thanks for the feedback. I have updated the PR with a more robust approach and a better description of the problem. I did not have time to investigate why the crash only happens with certain build configurations yet. Please excuse the force push. |
|
I think, we saw this same crash on Android too |
3 participants
U6Lib_n::close(): Do not call close() on NuvieIO buffers passed to us
via U6Lib_n::open(). Let the caller handle this instead.
Prevents a crash caused by the following events:
The game detects the files of the FM-Towns version
("townsu6" in the game directory) and eventually attempts to load
"sounds1.dat" in TownsSfxManager::loadSound1Dat()
Here, it creates local objects U6Lib_n "lib" and NuvieIOBuffer "iobuf"
File data is loaded into "iobuf", which is then passed to "lib" via
pointer. This pointer is stored by "lib"
When TownsSfxManager::loadSound1Dat() returns, "iobuf" goes out of
scope and is destroyed before "lib"
The destructor of "lib" tries to call close() via the stale pointer,
thus causing the crash
Fixes #14429