[Half-Life] Bullsquid crashes the game when NPC enemy dies at specific time

[hobokenn]

Similar to #2088, but doesn't seem to work with the player himself, couldn't reproduce in OpFor or Blue Shift. vid save

[SamVanheer]

It's probably this code:

halflife/dlls/bullsquid.cpp

Lines 531 to 569 in c7240b9

	case BSQUID_AE_SPIT:
	{
	Vector vecSpitOffset;
	Vector vecSpitDir;
	UTIL_MakeVectors ( pev->angles );
	// !!!HACKHACK - the spot at which the spit originates (in front of the mouth) was measured in 3ds and hardcoded here.
	// we should be able to read the position of bones at runtime for this info.
	vecSpitOffset = ( gpGlobals->v_right * 8 + gpGlobals->v_forward * 37 + gpGlobals->v_up * 23 );
	vecSpitOffset = ( pev->origin + vecSpitOffset );
	vecSpitDir = ( ( m_hEnemy->pev->origin + m_hEnemy->pev->view_ofs ) - vecSpitOffset ).Normalize();
	vecSpitDir.x += RANDOM_FLOAT( -0.05, 0.05 );
	vecSpitDir.y += RANDOM_FLOAT( -0.05, 0.05 );
	vecSpitDir.z += RANDOM_FLOAT( -0.05, 0 );
	// do stuff for this event.
	AttackSound();
	// spew the spittle temporary ents.
	MESSAGE_BEGIN( MSG_PVS, SVC_TEMPENTITY, vecSpitOffset );
	WRITE_BYTE( TE_SPRITE_SPRAY );
	WRITE_COORD( vecSpitOffset.x); // pos
	WRITE_COORD( vecSpitOffset.y);
	WRITE_COORD( vecSpitOffset.z);
	WRITE_COORD( vecSpitDir.x); // dir
	WRITE_COORD( vecSpitDir.y);
	WRITE_COORD( vecSpitDir.z);
	WRITE_SHORT( iSquidSpitSprite ); // model
	WRITE_BYTE ( 15 ); // count
	WRITE_BYTE ( 210 ); // speed
	WRITE_BYTE ( 25 ); // noise ( client will divide by 100 )
	MESSAGE_END();
	CSquidSpit::Shoot( pev, vecSpitOffset, vecSpitDir * 900 );
	}
	break;

The Gonome code was based on this so it makes sense that it would have the same bugs.

[BlackShadow]

It's probably this code:

halflife/dlls/bullsquid.cpp

Lines 531 to 569 in c7240b9

	case BSQUID_AE_SPIT:
	{
	Vector vecSpitOffset;
	Vector vecSpitDir;
	UTIL_MakeVectors ( pev->angles );
	// !!!HACKHACK - the spot at which the spit originates (in front of the mouth) was measured in 3ds and hardcoded here.
	// we should be able to read the position of bones at runtime for this info.
	vecSpitOffset = ( gpGlobals->v_right * 8 + gpGlobals->v_forward * 37 + gpGlobals->v_up * 23 );
	vecSpitOffset = ( pev->origin + vecSpitOffset );
	vecSpitDir = ( ( m_hEnemy->pev->origin + m_hEnemy->pev->view_ofs ) - vecSpitOffset ).Normalize();
	vecSpitDir.x += RANDOM_FLOAT( -0.05, 0.05 );
	vecSpitDir.y += RANDOM_FLOAT( -0.05, 0.05 );
	vecSpitDir.z += RANDOM_FLOAT( -0.05, 0 );
	// do stuff for this event.
	AttackSound();
	// spew the spittle temporary ents.
	MESSAGE_BEGIN( MSG_PVS, SVC_TEMPENTITY, vecSpitOffset );
	WRITE_BYTE( TE_SPRITE_SPRAY );
	WRITE_COORD( vecSpitOffset.x); // pos
	WRITE_COORD( vecSpitOffset.y);
	WRITE_COORD( vecSpitOffset.z);
	WRITE_COORD( vecSpitDir.x); // dir
	WRITE_COORD( vecSpitDir.y);
	WRITE_COORD( vecSpitDir.z);
	WRITE_SHORT( iSquidSpitSprite ); // model
	WRITE_BYTE ( 15 ); // count
	WRITE_BYTE ( 210 ); // speed
	WRITE_BYTE ( 25 ); // noise ( client will divide by 100 )
	MESSAGE_END();
	CSquidSpit::Shoot( pev, vecSpitOffset, vecSpitDir * 900 );
	}
	break;

The Gonome code was based on this so it makes sense that it would have the same bugs.

vecSpitDir = ((m_hEnemy->pev->origin + m_hEnemy->pev->view_ofs) - vecSpitOffset).Normalize();

This string causes the crash, i'm not sure why. Can't we create like a aimlock function for spitoffset to enemy's last position? Which will pretty much do the same thing.

[SamVanheer]

It's crashing because it's dereferencing the pointer to the enemy without checking if the pointer is non-null first. It's easy to fix, just use the same solution as the one used for the Gonome.

[hobokenn]

update: was able to reproduce the crash in op4 and blue shift, also i have noticed the same crash happens with pit drones in op4. i made a save a while ago thinking it was something else, if anyone wants to try it - gotcha.zip. how it works: you load a save, make no inputs and if Otis is gibbed it will crash ~0.7s later, however if you move left fast enough pit drone in the back will notice you and the game won't crash.

[SamVanheer]

Yep, Pit Drones have the exact same code, with the exact same bug.