Crash when detaching weapon from Combat Shield

[tomaszkot1]

Describe the bug
Game crashes with
app/bin/CortexCommand: line 44: 15 Aborted (core dumped) "/app/lib/CortexCommand/CortexCommand" $@
when trying to detach weapon from Combat Shield

To Reproduce
Steps to reproduce the behavior:

1. Spawn someone with Combat Shield and attachable weapon
2. Attach the weapon to the shield
3. Select "Detach" from the circular menu

It doesn't happen 100% of the time but I was able to detach at most once before crashing.

Additional context
Tested on 6.2.2 installed via flatpak.

           PID: 19050 (CortexCommand)
           UID: 1000 (user)
           GID: 1000 (user)
        Signal: 6 (ABRT)
     Timestamp: Mon 2025-09-01 18:26:27 CEST (1min 52s ago)
  Command Line: /app/lib/CortexCommand/CortexCommand
    Executable: /app/lib/CortexCommand/CortexCommand
 Control Group: /user.slice/user-1000.slice/user@1000.service/app.slice/app-flatpak-io.github.cortex_command_community.Cortex\x2dCommand\x2dCommunity\x2dProject-19026.scope
          Unit: user@1000.service
     User Unit: app-flatpak-io.github.cortex_command_community.Cortex\x2dCommand\x2dCommunity\x2dProject-19026.scope
         Slice: user-1000.slice
     Owner UID: 1000 (user)
       Boot ID: e688771a35de441ab297081937eef877
    Machine ID: 14fbba364bc84d1f8230c3bb008bb057
      Hostname: hostname
       Storage: /var/lib/systemd/coredump/core.CortexCommand.1000.e688771a35de441ab297081937eef877.19050.1756743987000000.zst (present)
  Size on Disk: 274.1M
       Message: Process 19050 (CortexCommand) of user 1000 dumped core.

            Stack trace of thread 15:
            #0  0x000078b1cf09b344 n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x9a344)
            #1  0x000078b1cf04250e n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x4150e)
            #2  0x000078b1cf029882 n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x28882)
            #3  0x000064d28644f4bc n/a (/app/lib/CortexCommand/CortexCommand + 0xd84bc)
            #4  0x000078b1cf0425c0 n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x415c0)
            #5  0x000064d28699c23c n/a (/app/lib/CortexCommand/CortexCommand + 0x62523c)
            #6  0x000064d28660a7ee n/a (/app/lib/CortexCommand/CortexCommand + 0x2937ee)
            #7  0x000064d28660af18 n/a (/app/lib/CortexCommand/CortexCommand + 0x293f18)
            #8  0x000064d2865511c2 n/a (/app/lib/CortexCommand/CortexCommand + 0x1da1c2)
            #9  0x000064d286575f47 n/a (/app/lib/CortexCommand/CortexCommand + 0x1fef47)
            #10 0x000064d2866f94e4 n/a (/app/lib/CortexCommand/CortexCommand + 0x3824e4)
            #11 0x000064d2864c1773 n/a (/app/lib/CortexCommand/CortexCommand + 0x14a773)
            #12 0x000064d28647c0a3 n/a (/app/lib/CortexCommand/CortexCommand + 0x1050a3)
            #13 0x000078b1cf02b3c8 n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x2a3c8)
            #14 0x000078b1cf02b48b n/a (/usr/lib/x86_64-linux-gnu/libc.so.6 + 0x2a48b)
            #15 0x000064d2864bfda5 n/a (/app/lib/CortexCommand/CortexCommand + 0x148da5)
            ELF object binary architecture: AMD x86-64

If you can't recreate the issue please let me know, I will try to install debug packages to get a more meaningful stack trace.

[HeliumAnt]

Still happening in current tree, very reproducible

[Architector4]

Just compiled latest commit from development branch in debug mode, ran the game, went to Test Activity, to Tutorial Bunker with just Team 1 set, spawned a Brain Robot with Coalition's Gatling Gun and Combat Shield, context menued to "Done Building", switch to the shield, went to context menued to "Attach", waited a sec, context menued to "Detach", got a long freeze and a crash with the following output:

Detailed stack trace

Stack trace (most recent call last):
#17   Object "", at 0xffffffffffffffff, in
#16   Object "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/CortexCommand", at 0x5605f9ddbbb4, in _start
#15   Object "/usr/lib/libc.so.6", at 0x7f7e94e27c4a, in __libc_start_main
#14   Object "/usr/lib/libc.so.6", at 0x7f7e94e27b8a, in __libc_init_first
#13   Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Main.cpp", line 468, in main [0x5605f9dde589]
        465: 			RunMenuLoop();
        466: 		}
        467:
      > 468: 		RunGameLoop();
        469: 	}
        470:
        471: 	g_ThreadMan.GetPriorityThreadPool().wait_for_tasks();
#12   Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Main.cpp", line 354, in RunGameLoop() [0x5605f9ddd97b]
        351: 			}
        352:
        353: 			g_LuaMan.ClearScriptTimings();
      > 354: 			g_MovableMan.Update();
        355: 			g_PerformanceMan.UpdateSortedScriptTimings(g_LuaMan.GetScriptTimings());
        356:
        357: 			g_AudioMan.Update();
#11   Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Managers/MovableMan.cpp", line 1405, in RTE::MovableMan::Update() [0x5605fa247292]
       1403: 			g_PerformanceMan.StartPerformanceMeasurement(PerformanceMan::ActorsUpdate);
       1404: 			for (Actor* actor: m_Actors) {
      >1405: 				actor->Update();
       1406:
       1407: 				g_PerformanceMan.StartPerformanceMeasurement(PerformanceMan::ScriptsUpdate);
       1408: 				actor->UpdateScripts();
#10   Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Entities/AHuman.cpp", line 2386, in RTE::AHuman::Update() [0x5605f9ee3920]
       2384: 	float rot = m_Rotation.GetRadAngle(); // eugh, for backwards compat to be the same behaviour as with multithreaded AI
       2385:
      >2386: 	Actor::Update();
       2387:
       2388: 	////////////////////////////////////
       2389: 	// Update viewpoint
#9    Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Entities/Actor.cpp", line 1115, in RTE::Actor::Update() [0x5605f9ea6f0a]
       1112: 	// Hit Body update and handling
       1113: 	MOSRotating::Update();
       1114:
      >1115: 	m_PieMenu->Update();
       1116:
       1117: 	// Update the viewpoint to be at least what the position is
       1118: 	m_ViewPoint = m_Pos;
#8    Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Entities/PieMenu.cpp", line 615, in RTE::PieMenu::Update() [0x5605f9fc6ada]
        612: 		}
        613:
        614: 		if (m_HoveredPieSlice && m_EnabledState != EnabledState::Disabled && !m_ActiveSubPieMenu) {
      > 615: 			UpdateSliceActivation();
        616: 		}
        617:
        618: 		if (!IsSubPieMenu()) {
#7    Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Entities/PieMenu.cpp", line 861, in RTE::PieMenu::UpdateSliceActivation() [0x5605f9fc8919]
        858: 			m_ActiveSubPieMenu->m_HoverTimer.Reset();
        859: 		} else if (m_ActivatedPieSlice && m_ActivatedPieSlice->GetLuabindFunctionObjectWrapper() && m_ActivatedPieSlice->GetLuabindFunctionObjectWrapper()->GetLuabindObject()) {
        860: 			if (const MovableObject* scriptTarget = m_Owner ? m_Owner : m_AffectedObject) {
      > 861: 				g_LuaMan.GetMasterScriptState().RunScriptFunctionObject(m_ActivatedPieSlice->GetLuabindFunctionObjectWrapper(), "", "", {scriptTarget, this, m_ActivatedPieSlice});
        862: 			}
        863: 		}
        864: 	}
#6    Source "/media/ext_hdd/nobackup/architector4/Downloads/Cortex-Command-Community-Project/builddebug/../Source/Managers/LuaMan.cpp", line 636, in RTE::LuaStateWrapper::RunScriptFunctionObject(RTE::LuabindObjectWrapper const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<RTE::Entity const*, std::allocator<RTE::Entity const*> > const&, std::vector<std::basic_string_view<char, std::char_traits<char> >, std::allocator<std::basic_string_view<char, std::char_traits<char> > > > const&, std::vector<RTE::LuabindObjectWrapper*, std::allocator<RTE::LuabindObjectWrapper*> > const&) [0x5605faa5af66]
        634: 	// only track time in non-MT scripts, for now
        635: 	if (&g_LuaMan.GetMasterScriptState() == this) {
      > 636: 		m_ScriptTimings[path].m_Time += std::chrono::duration_cast<std::chrono::microseconds>(end - begin).count();
        637: 		m_ScriptTimings[path].m_CallCount++;
        638: 	}
#5    Source "/usr/include/c++/15.2.1/bits/unordered_map.h", line 1058, in std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, RTE::PerformanceMan::ScriptTiming, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, RTE::PerformanceMan::ScriptTiming> > >::operator[](std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) [0x5605faa75dfe]
       1055:        */
       1056:       mapped_type&
       1057:       operator[](const key_type& __k)
      >1058:       { return _M_h[__k]; }
       1059:
       1060:       mapped_type&
       1061:       operator[](key_type&& __k)
#4    Source "/usr/include/c++/15.2.1/bits/hashtable_policy.h", line 886, in std::__detail::_Map_base<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, RTE::PerformanceMan::ScriptTiming>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, RTE::PerformanceMan::ScriptTiming> >, std::__detail::_Select1st, std::equal_to<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true>, true>::operator[](std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) [0x5605faa7cc02]
        883:     -> mapped_type&
        884:     {
        885:       __hashtable* __h = static_cast<__hashtable*>(this);
      > 886:       __hash_code __code = __h->_M_hash_code(__k);
        887:       size_t __bkt = __h->_M_bucket_index(__code);
        888:       if (auto __node = __h->_M_find_node(__bkt, __k, __code))
        889: 	return __node->_M_v().second;
#3    Source "/usr/include/c++/15.2.1/bits/hashtable_policy.h", line 1071, in std::__detail::_Hash_code_base<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, RTE::PerformanceMan::ScriptTiming>, std::__detail::_Select1st, std::hash<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, true>::_M_hash_code(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const [0x5605faa80bf0]
       1068:       {
       1069: 	static_assert(__is_invocable<const _Hash&, const _Key&>{},
       1070: 	    "hash function must be invocable with an argument of key type");
      >1071: 	return _M_hash._M_obj(__k);
       1072:       }
       1073:
       1074:       template<typename _Kt>
#2    Source "/usr/include/c++/15.2.1/bits/basic_string.h", line 4912, in std::__str_hash_base<char, std::allocator<char>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > >::operator()(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const [0x5605f9df0a4f]
       4909:       [[__nodiscard__]]
       4910:       size_t
       4911:       operator()(const _StrT& __s) const noexcept
      >4912:       { return _Hash_impl::hash(__s.data(), __s.length() * sizeof(_CharT)); }
       4913:     };
       4914:
       4915: #ifndef _GLIBCXX_COMPATIBILITY_CXX0X
#1    Source "/usr/include/c++/15.2.1/bits/functional_hash.h", line 209, in std::_Hash_impl::hash(void const*, unsigned long, unsigned long) [0x5605f9ddfb60]
        206:     static size_t
        207:     hash(const void* __ptr, size_t __clength,
        208: 	 size_t __seed = static_cast<size_t>(0xc70f6907UL))
      > 209:     { return _Hash_bytes(__ptr, __clength, __seed); }
        210:
        211:     template<typename _Tp>
        212:       static size_t
#0    Source "/usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/hash_bytes.cc", line 151, in std::_Hash_bytes(void const*, unsigned long, unsigned long) [0x7f7e952b43c0]
Segmentation fault (Signal sent by the kernel [(nil)])
Segmentation fault         builddebug/CortexCommand

[Architector4]

I stepped through it with a debugger, and, as it appears, the Lua call corrupts the path variable. Here's a recording.

In this case it turned into partial garbage, which is a case where the detachment will happen properly, but more often the data pointer in the std::string object gets corrupted I guess, and I get an error from gdb like <error: Cannot access memory at address 0x15> (literally that's what it said), or another time ...at address 0x6e65502f73646e75.

failmoment.mp4

[Architector4]

I've debugged deeper with gdb, and found where exactly the string gets corrupted. As far as I can tell, this is because the Lua script for detaching is run from the pie slice menu item, which runs RemoveAttachable, which runs C++ code that then deletes the said pie slice because it belongs to the detached item, corrupting its data in the moment.

Backtrace from gdb at that exact moment

(gdb) bt
#0  RTE::PieMenu::RemovePieSlicesByOriginalSource (this=0x55557d476430, originalSource=0x55555b8040f0) at ../Source/Entities/PieMenu.cpp:458
#1  0x00005555557b8b64 in RTE::Attachable::AddOrRemovePieSlicesAndListenersFromPieMenu (this=0x55555b8040f0, pieMenuToModify=0x55557d476430, addToPieMenu=false)
    at ../Source/Entities/Attachable.cpp:609
#2  0x00005555557b7d32 in RTE::Attachable::SetParent (this=0x55555b8040f0, newParent=0x0) at ../Source/Entities/Attachable.cpp:541
#3  0x000055555582be22 in RTE::MOSRotating::RemoveAttachable (this=0x55557064ddc0, attachable=0x55555b8040f0, addToMovableMan=false, addBreakWounds=false) at ../Source/Entities/MOSRotating.cpp:1507
#4  0x00005555557b7450 in RTE::Attachable::RemoveAttachable (this=0x55557064ddc0, attachable=0x55555b8040f0, addToMovableMan=false, addBreakWounds=false) at ../Source/Entities/Attachable.cpp:466
#5  0x0000555556730c19 in luabind::detail::returns<RTE::Attachable*>::call<RTE::MOSRotating, RTE::MOSRotating, luabind::detail::null_type, RTE::Attachable*, bool, bool> (
    f=&virtual table offset 720, L=0x7fffe6c07380) at ../external/sources/luabind-0.7.1/luabind/detail/call.hpp:152
#6  0x00005555566d4774 in luabind::detail::call<RTE::MOSRotating, RTE::MOSRotating, luabind::detail::null_type, RTE::Attachable*, RTE::Attachable*, bool, bool> (f=&virtual table offset 720,
    L=0x7fffe6c07380) at ../external/sources/luabind-0.7.1/luabind/detail/call.hpp:403
#7  0x000055555668c988 in luabind::detail::mem_fn_callback<RTE::Attachable* (RTE::MOSRotating::*)(RTE::Attachable*, bool, bool), RTE::MOSRotating, luabind::detail::null_type>::operator() (
    this=0x555558c316a8, L=0x7fffe6c07380) at ../external/sources/luabind-0.7.1/luabind/class.hpp:223
#8  0x000055555664e8f3 in boost::detail::function::function_obj_invoker1<luabind::detail::mem_fn_callback<RTE::Attachable* (RTE::MOSRotating::*)(RTE::Attachable*, bool, bool), RTE::MOSRotating, luabind::detail::null_type>, int, lua_State*>::invoke (function_obj_ptr=..., a0=0x7fffe6c07380) at ../external/include/boost_1_75/boost/function/function_template.hpp:137
#9  0x00005555562d1630 in boost::function1<int, lua_State*>::operator() (this=0x555558c316a0, a0=0x7fffe6c07380) at ../external/include/boost_1_75/boost/function/function_template.hpp:763
#10 0x00005555562d2621 in luabind::detail::overload_rep::call (this=0x555558c31670, L=0x7fffe6c07380, force_static_call=false) at ../external/sources/luabind-0.7.1/src/overload_rep.cpp:32
#11 0x00005555562c2f23 in luabind::detail::class_rep::function_dispatcher (L=0x7fffe6c07380) at ../external/sources/luabind-0.7.1/src/class_rep.cpp:667
#12 0x000055555623e026 in lj_BC_FUNCC () at external/sources/LuaJIT-2.1/src/lj_vm.s:857
#13 0x0000555556220b36 in lua_pcall (L=0x7fffe6c07380, nargs=3, nresults=-1, errfunc=-5) at ../external/sources/LuaJIT-2.1/src/lj_api.c:1145
#14 0x00005555562f2a92 in RTE::LuaStateWrapper::RunScriptFunctionObject (this=0x5555573fc4a0, functionObject=0x55557d5db2a0, selfGlobalTableName="", selfGlobalTableKey="",
    functionEntityArguments=std::vector of length 3, capacity 3 = {...}, functionLiteralArguments=std::vector of length 0, capacity 0, functionObjectArguments=std::vector of length 0, capacity 0)
    at ../Source/Managers/LuaMan.cpp:624
#15 0x000055555586091a in RTE::PieMenu::UpdateSliceActivation (this=0x55557d476430) at ../Source/Entities/PieMenu.cpp:861
#16 0x000055555585eadb in RTE::PieMenu::Update (this=0x55557d476430) at ../Source/Entities/PieMenu.cpp:615
#17 0x000055555573ef0b in RTE::Actor::Update (this=0x55556ff7a880) at ../Source/Entities/Actor.cpp:1115
#18 0x000055555577b921 in RTE::AHuman::Update (this=0x55556ff7a880) at ../Source/Entities/AHuman.cpp:2386
#19 0x0000555555adf293 in RTE::MovableMan::Update (this=0x555557422cc0) at ../Source/Managers/MovableMan.cpp:1405
#20 0x000055555567597c in RunGameLoop () at ../Source/Main.cpp:354
#21 0x000055555567658a in main (argc=1, argv=0x7fffffffdc48) at ../Source/Main.cpp:468