Skip to content

Fix faulty references when spawning mobjs

When some types of mobjs are spawning, it will additionally spawn in a few additional mobjs that depend on it. A few typical examples of this are Crushstacean's claw or Egg Guard's shield. Since this is considered part of the original mobj, it creates a reference to it, often by the target field of the mobj. However, due to wrong order of execution when initializing the thinker, the reference is spawned before the thinker is initialized, which resets the reference counter to 0 even when there is an mobj that is referencing it. The end result is that the engine might think that the mobj no longer has any references when it has, and proceeds to free the mobj from memory, which can trigger segfaults later when the referenced object tries to access it. The other case, which is far more common, is that the reference counter underflows and starts to reference bogus counts, which prevents the mobj from being freed properly.

The fix is to simply move the thinker initialization to before spawning it's child mobjs, to make sure that the reference counter is ready before the child mobjs starts spawning.

Merge request reports