Merge branch 'copying' into 'master'

Avoid unnecessary LiveCellRef copying; Fix potential use-after-free in WorldModel

See merge request OpenMW/openmw!3276

apps/openmw/mwgui/charactercreation.cpp

@@ -245,7 +245,7 @@ namespace MWGui
 
                     const ESM::NPC* playerNpc = world->getPlayerPtr().get<ESM::NPC>()->mBase;
 
-                    const MWWorld::Player player = world->getPlayer();
+                    const MWWorld::Player& player = world->getPlayer();
 
                     const ESM::Class* playerClass = world->getStore().get<ESM::Class>().find(playerNpc->mClass);
 

apps/openmw/mwworld/manualref.cpp

@@ -16,9 +16,7 @@ namespace
         cellRef.blank();
         cellRef.mRefID = name;
 
-        MWWorld::LiveCellRef<T> ref(cellRef, base);
-
-        refValue = ref;
+        refValue = MWWorld::LiveCellRef<T>(cellRef, base);
         ptrValue = MWWorld::Ptr(&std::any_cast<MWWorld::LiveCellRef<T>&>(refValue), nullptr);
     }
 }

apps/openmw/mwworld/worldmodel.hpp

@@ -102,6 +102,8 @@ namespace MWWorld
         bool readRecord(ESM::ESMReader& reader, uint32_t type, const std::map<int, int>& contentFileMap);
 
     private:
+        PtrRegistry mPtrRegistry; // defined before mCells because during destruction it should be the last
+
         MWWorld::ESMStore& mStore;
         ESM::ReadersCache& mReaders;
         mutable std::unordered_map<ESM::RefId, CellStore> mCells;
@@ -110,7 +112,6 @@ namespace MWWorld
         ESM::Cell mDraftCell;
         std::vector<std::pair<ESM::RefId, CellStore*>> mIdCache;
         std::size_t mIdCacheIndex = 0;
-        PtrRegistry mPtrRegistry;
 
         CellStore& getOrInsertCellStore(const ESM::Cell& cell);