Skip to content

Fix crash when freeing a vehicle model while its detached parts exist#4947

Open
TheCrazy17 wants to merge 1 commit into
multitheftauto:masterfrom
TheCrazy17:fix/detached-parts-freed-model
Open

Fix crash when freeing a vehicle model while its detached parts exist#4947
TheCrazy17 wants to merge 1 commit into
multitheftauto:masterfrom
TheCrazy17:fix/detached-parts-freed-model

Conversation

@TheCrazy17

Copy link
Copy Markdown

Summary

Fixes a client crash (access violation in CVehicleModelInfo::SetVehicleColour, offset 0x000C84D8) when a custom vehicle model allocated with engineRequestModel is freed after the vehicle exploded.

Detached car parts spawned by CAutomobile::SpawnFlyingComponent (doors, bonnet, etc. flying off an exploding vehicle) are temporary game objects that store the model index of the vehicle they came from (CObject::m_nRefModelIndex + the bChangesVehColor flag), so CObject::Render can repaint them with that vehicle's colours and CObject's destructor can release its model reference. These parts outlive the vehicle element, so deallocating the model while they existed made both paths dereference the freed model info.

The fix clears those references from the game's object pool when a vehicle model info is deallocated (CModelInfoSA::DeallocateModel), the same way the game marks parts without a source vehicle (-1). It also names the two CObjectSAInterface fields involved, verified against the documented CObject layout.

Motivation

Fixes #4911

Test plan

Using the script from the issue (explode → destroy → engineFreeModel), which crashed reliably before:

  • No crash when the model is freed while parts are still flying, nor when freeing before destroyElement.
  • No crash when the parts despawn naturally afterwards (destructor path).
  • Variants tested: freeing immediately after blowVehicle, several vehicles sharing the same custom model exploded at once, and re-allocating the same model ID after freeing it.
  • Parts of vehicles with standard models still get repainted with the vehicle's colours as usual.

Checklist

  • Your code should follow the coding guidelines.
  • Smaller pull requests are easier to review. If your pull request is beefy, your pull request should be reviewable commit-by-commit.

Detached car parts spawned by CAutomobile::SpawnFlyingComponent (doors,
bonnets etc. flying off an exploding vehicle) are temporary objects that
keep the model index of the vehicle they came from, so CObject::Render can
repaint them with that vehicle's colours and CObject's destructor can
release its model reference. They outlive the vehicle, so deallocating a
custom vehicle model (engineFreeModel) while such parts existed made both
paths dereference the freed model info (pure virtual call / access
violation in CVehicleModelInfo::SetVehicleColour).

Clear those references from the object pool when a vehicle model info is
deallocated. Also names the two CObjectSAInterface fields involved.

Fixes multitheftauto#4911
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Crash in EngineRequestModel/EngineFreeModel with blowVehicle

1 participant