[1.1b2 BUG] Heap corruptions when exposing SimObjectPtr fields to script - LOGGED

I'm re-purposing this thread with the description of this issue in 1.1b2, and an updated fix.

In 1.1b2, the TypeSimObjectPtr field type is gone, and in its place is the TYPEID<> system, which is much improved in that it assigns unique type ids for each script-exposed class, making it easier to expose pointers to such objects as fields.

However, they will not work as one would expect if the member variable is a SimObjectPtr, instead of a plain pointer to the class type: the field system stores void pointers to the exposed data, and will cast them to pointers. The SimObjectPtr is a completely different beast: it contains a pointer to a Reference object, which in turn contains a pointer to the object. When a SimObjectPtr is assigned an object, it registers with that object so it's reference can be cleared when the object is deleted. So, casting the raw memory address of a SimObjectPtr<T> into a pointer to T and writing to it will cause memory corruption, which will lead to crashes in odd places.

This problem existed in previous versions, but was much more subtle because SimObjectPtr stored a pointer to the object directly and could be written to and read from as a raw pointer (things would only blow up when deleting the reference). Back then I came up with a specific field type for SimObjectPtr members, which did the correct type casting. Here's the fix that works for 1.1b2:

In console/consoleTypes.h, add this:

DefineConsoleType( TypeSimObjectSafePtr, SimObjectPtr<SimObject> )

In console/consoleTypes.cpp, add this:

ConsoleType( SimObjectPointer, TypeSimObjectSafePtr, SimObjectPtr<SimObject> )
ImplementConsoleTypeCasters( TypeSimObjectSafePtr, SimObjectPtr<SimObject> ) //beta2

ConsoleSetType( TypeSimObjectSafePtr )
{
   if(argc == 1)
   {
      SimObjectPtr<SimObject> *obj = (SimObjectPtr<SimObject>*)dptr;
      *obj = Sim::findObject(argv[0]);
   }
   else
      Con::printf("(TypeSimObjectSafePtr) Cannot set multiple args to a single S32.");
}

ConsoleGetType( TypeSimObjectSafePtr )
{
   SimObjectPtr<SimObject> *obj = (SimObjectPtr<SimObject>*)dptr;
   char* returnBuffer = Con::getReturnBuffer(256);
   dSprintf(returnBuffer, 256, "%s", *obj ? (*obj)->getName() ? (*obj)->getName() : (*obj)->getIdString() : "");
   return returnBuffer;
}

In console/engineStructs.h add this: (only for beta 2)

class SimObject;
template< typename T > class SimObjectPtr;
DECLARE_STRUCT( SimObjectPtr<SimObject> );

In console/engineStructs.cpp add this: (only for beta 2)

IMPLEMENT_STRUCT( SimObjectPtr<SimObject>,
   SimObjectPointer,,
   "" )
END_IMPLEMENT_STRUCT;

Done, all you need is to use TypeSimObjectSafePtr instead of TYPEID<SomeClass>() in beta 2 or TypeSimObjectPtr in beta 1 and earlier when exposing a SimObjectPtr field (don't use TypeSimObjectSafePtr for raw pointers!).

And here are the members I found which are SimObjectPtr types but are exposed using TYPEID<> or other unsuitable types in beta2:

RenderFormatToken::mCopyPostEffect
RenderFormatToken::mResolvePostEffect
ForcedMaterialMeshMgr::mOverrideMaterial
RenderPassStateBin::mStateToken
GuiControlProfile::mSoundButtonDown
GuiControlProfile::mSoundButtonOver
SFXSource::mDescription;