Possible bad item_iter in map::process_items_in_vehicle

[Moycakes]

Installing any sort of active object into this vehicle causes the game to crash.
A friend and I tried debugging it, but without a larger understanding of how everything works, we didn't get very far.
It seems the item_iter in cataclysm-tiles.exe!map::process_items_in_vehicle becomes corrupt, or the item that's created in the process function is corrupt, causing bad memory access.

Steps To Reproduce

Steps to reproduce the behavior:
Install an active object into the van that the player is standing in, Such as the recharging station that she is holding.
Move/wait a turn afterwards.

Expected behavior

It shouldn't crash.

Versions and configuration

• OS: Windows
  • OS Version: 10.0 1803
• Game Version: 0.9-59118-gb7ef9394a4 [64-bit]
• Graphics Version: Tiles
• Mods loaded: [
  Dark Days Ahead [dda],
  Disable NPC Needs [no_npc_food],
  Garden Pots [growable-pots],
  Icecoon's Arsenal [ew_pack],
  Makeshift Items Mod [makeshift],
  More Survival Tools [More_Survival_Tools],
  Alternative Map Key [alt_map_key],
  More Locations [more_locations],
  Fuji's More Buildings [FujiStruct],
  Folding Parts pack [deoxymod],
  Vehicle Additions Pack [blazemod]
  ]

Additional context

Add any other context about the problem here.

Sespe.zip

[kiranoot]

I looked into this and it appears that the cause for this is that active_items contains pointers and iterators into the items member of many vehicle parts, which are allocated inside the vehicle parts member.

These pointers and iterators become invalidated when new parts are installed when the number of parts in a vehicle exceeds the capacity of the std::vector<> that holds the vehicle parts. The vector backing store is reallocated and the previous copy is destroyed breaking many many references.

Through debugging I have traced the exact point of corruption to the statement parts.push_back( new_part ); inside vehicle::install_part in vehicle.cpp

I haven't been able to come up with a good solution to this, as it doesn't appear that there is any convenient way to rebuild the active item cache for a vehicle.

It also seems that this random reallocation will be a problem as long as iterators and items references are stored in other areas of the vehicle.

[kevingranade]

Thanks for the research, that sounds all too likely.

We should be able to trigger emptying and re-creation of the active item container.

[irwiss]

Active items cache is recreated in refresh() now after #60952 and triggered by install_part/remove_part.

I'm not sure if there's any other dangling pointers left but this particular instance is likely resolved; save game is pretty old but doing the steps didn't reproduce the issue on latest master 71bdf7b

[Night-Pryanik]

Ok, closing until reconfirmed.