From c18de847980350e32eb0684a54cacd7daeaee013 Mon Sep 17 00:00:00 2001 From: scrawl Date: Fri, 17 Jun 2016 02:26:52 +0200 Subject: [PATCH] Fix a crash that could occur when two or more plugins move a deleted ref to another cell (Fixes #3446) --- apps/openmw/mwworld/store.cpp | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/apps/openmw/mwworld/store.cpp b/apps/openmw/mwworld/store.cpp index d1ba0ef0b..d28e465c2 100644 --- a/apps/openmw/mwworld/store.cpp +++ b/apps/openmw/mwworld/store.cpp @@ -512,12 +512,13 @@ namespace MWWorld bool deleted = false; cell->getNextRef(esm, ref, deleted); - // Add data required to make reference appear in the correct cell. - // We should not need to test for duplicates, as this part of the code is pre-cell merge. - cell->mMovedRefs.push_back(cMRef); - // But there may be duplicates here! if (!deleted) { + // Add data required to make reference appear in the correct cell. + // We should not need to test for duplicates, as this part of the code is pre-cell merge. + cell->mMovedRefs.push_back(cMRef); + + // But there may be duplicates here! ESM::CellRefTracker::iterator iter = std::find(cellAlt->mLeasedRefs.begin(), cellAlt->mLeasedRefs.end(), ref.mRefNum); if (iter == cellAlt->mLeasedRefs.end()) cellAlt->mLeasedRefs.push_back(ref); @@ -680,7 +681,10 @@ namespace MWWorld ESM::MovedCellRef target0 = *itold; ESM::Cell *wipecell = const_cast(search(target0.mTarget[0], target0.mTarget[1])); ESM::CellRefTracker::iterator it_lease = std::find(wipecell->mLeasedRefs.begin(), wipecell->mLeasedRefs.end(), it->mRefNum); - wipecell->mLeasedRefs.erase(it_lease); + if (it_lease != wipecell->mLeasedRefs.end()) + wipecell->mLeasedRefs.erase(it_lease); + else + std::cerr << "can't find " << it->mRefNum.mIndex << " " << it->mRefNum.mContentFile << " in leasedRefs " << std::endl; *itold = *it; } else