I think that would have the same consequences.
I also think that the fact that this solves the problem means the bug is caused by changing the object pointer.
Since it's passed by pointer-to-pointer, the call to script_driver may actually change the obj-pointer here. Which in turn causes the next loop iteration to be handling garbage - which then in turn causes a crash.
will this work?
Code:
void timer_otrigger(struct obj_data *obj)
{
trig_data *t;
+ obj_data *tmp = obj;
if (!SCRIPT_CHECK(obj, OTRIG_TIMER))
return;
for (t = TRIGGERS(SCRIPT(obj)); t; t = t->next) {
+ if (obj != tmp) {
+ // log that we hit a problem
+ break;
+ }
if (TRIGGER_CHECK(t, OTRIG_TIMER)) {
script_driver(&obj, t, OBJ_TRIGGER, TRIG_NEW);
}
}
return;
}
That last "return;" is optional, by the way. You can remove it with no bad effects.
