1 files changed, 51 insertions, 9 deletions

diff --git a/engines/sci/engine/klists.cpp b/engines/sci/engine/klists.cpp
index 66590da23f..e780d3cdc3 100644
--- a/engines/sci/engine/klists.cpp
+++ b/engines/sci/engine/klists.cpp
@@ -374,13 +374,21 @@ reg_t kFindKey(EngineState *s, int argc, reg_t *argv) {
 
 reg_t kDeleteKey(EngineState *s, int argc, reg_t *argv) {
 	reg_t node_pos = kFindKey(s, 2, argv);
-	Node *n;
 	List *list = s->_segMan->lookupList(argv[0]);
 
 	if (node_pos.isNull())
 		return NULL_REG; // Signal failure
 
-	n = s->_segMan->lookupNode(node_pos);
+	Node *n = s->_segMan->lookupNode(node_pos);
+
+#ifdef ENABLE_SCI32
+	for (int i = 1; i <= list->numRecursions; ++i) {
+		if (list->nextNodes[i] == node_pos) {
+			list->nextNodes[i] = n->succ;
+		}
+	}
+#endif
+
 	if (list->first == node_pos)
 		list->first = n->succ;
 	if (list->last == node_pos)
@@ -486,7 +494,7 @@ reg_t kListAt(EngineState *s, int argc, reg_t *argv) {
 	List *list = s->_segMan->lookupList(argv[0]);
 	reg_t curAddress = list->first;
 	if (list->first.isNull()) {
-		error("kListAt tried to reference empty list (%04x:%04x)", PRINT_REG(argv[0]));
+		// Happens in Torin when examining Di's locket in chapter 3
 		return NULL_REG;
 	}
 	Node *curNode = s->_segMan->lookupNode(curAddress);
@@ -544,9 +552,18 @@ reg_t kListEachElementDo(EngineState *s, int argc, reg_t *argv) {
 
 	ObjVarRef address;
 
+	++list->numRecursions;
+
+	if (list->numRecursions > ARRAYSIZE(list->nextNodes)) {
+		error("Too much recursion in kListEachElementDo");
+	}
+
 	while (curNode) {
-		// We get the next node here as the current node might be gone after the invoke
-		reg_t nextNode = curNode->succ;
+		// We get the next node here as the current node might be deleted by the
+		// invoke. In the case that the next node is also deleted, kDeleteKey
+		// needs to be able to adjust the location of the next node, which is
+		// why it is stored on the list instead of on the stack
+		list->nextNodes[list->numRecursions] = curNode->succ;
 		curObject = curNode->value;
 
 		// First, check if the target selector is a variable
@@ -559,11 +576,18 @@ reg_t kListEachElementDo(EngineState *s, int argc, reg_t *argv) {
 			}
 		} else {
 			invokeSelector(s, curObject, slc, argc, argv, argc - 2, argv + 2);
+			// Check if the call above leads to a game restore, in which case
+			// the segment manager will be reset, and the original list will
+			// be invalidated
+			if (s->abortScriptProcessing == kAbortLoadGame)
+				return s->r_acc;
 		}
 
-		curNode = s->_segMan->lookupNode(nextNode);
+		curNode = s->_segMan->lookupNode(list->nextNodes[list->numRecursions]);
 	}
 
+	--list->numRecursions;
+
 	return s->r_acc;
 }
 
@@ -669,26 +693,44 @@ reg_t kArray(EngineState *s, int argc, reg_t *argv) {
 	// TODO: we need to either merge SCI2 strings and
 	// arrays together, and in the future merge them with
 	// the SCI1 strings and arrays in the segment manager
+	bool callStringFunc = false;
 	if (op == 0) {
 		// New, check if the target type is 3 (string)
 		if (argv[2].toUint16() == 3)
-			return kString(s, argc, argv);
+			callStringFunc = true;
 	} else {
 		if (s->_segMan->getSegmentType(argv[1].getSegment()) == SEG_TYPE_STRING ||
 			s->_segMan->getSegmentType(argv[1].getSegment()) == SEG_TYPE_SCRIPT) {
-			return kString(s, argc, argv);
+			callStringFunc = true;
 		}
 
 #if 0
 		if (op == 6) {
 			if (s->_segMan->getSegmentType(argv[3].getSegment()) == SEG_TYPE_STRING ||
 				s->_segMan->getSegmentType(argv[3].getSegment()) == SEG_TYPE_SCRIPT) {
-				return kString(s, argc, argv);
+				callStringFunc = true;
 			}
 		}
 #endif
 	}
 
+	if (callStringFunc) {
+		Kernel *kernel = g_sci->getKernel();
+		uint16 kernelStringFuncId = kernel->_kernelFunc_StringId;
+		if (kernelStringFuncId) {
+			const KernelFunction *kernelStringFunc = &kernel->_kernelFuncs[kernelStringFuncId];
+
+			if (op < kernelStringFunc->subFunctionCount) {
+				// subfunction-id is valid
+				const KernelSubFunction *kernelStringSubCall = &kernelStringFunc->subFunctions[op];
+				argc--;
+				argv++; // remove subfunction-id from arguments
+				// and call the kString subfunction
+				return kernelStringSubCall->function(s, argc, argv);
+			}
+		}
+	}
+
 	switch (op) {
 	case 0: { // New
 		reg_t arrayHandle;