Bug due to variable overflow when AI chooses new Pokemon to send out

[Pawkkie]

Description

In the GetBestMonTypeMatchup function in battle_ai_switch_items.c (highlighted here ), we calculate the most suitable defense mon to use in the AI's decision of what mon to send out after the previous one faints. Was having some issues (you can see my Discord post and bug discovery here and here), and found this.

The typeEffectiveness variable seems to be overflowing, and that overflow is causing the AI to make incorrect decisions.

I looked into GetTypeModifier, which returns an effectiveness value from sTypeEffectivenessTable, which stores type effectiveness in UQ_4_12 format, seen here. The conversion to UQ_4_12 is here. This format scales input numbers by 4096.

The typeEffectiveness variable I linked in my previous post is u32, which has a max value of just under 4.3 x 10^9. typeEffectiveness is initialized to UQ_4_12(1.0), which is 4096 in decimal. Any neutral result from GetTypeModifier multiplies by 4096, any resisted value multiplies by 2048, and any effective value multiplies by 8192.

This means typeEffectiveness overflows as soon as you hit a case where either mon has two typings unless there's an immunity, because even the smallest multiplier in a two typing case is 4096 * 2048 * 2048, about 1.7 * 10 ^10, and much bigger than typeEffectiveness can store. As far as I can tell, the default behaviour is functionally random for cases where mons have multiple types because it sort of is, depending on how the compiler is handling the overflow.

Version

1.5.0 (Default)

Upcoming Version

No response

Discord contact info

@Pawkkie