bugfix(contain): Prevent riders from being added to destroyed container object when Reinforcement Pad is destroyed before Troop Crawler drop (TheSuperHackers#2746)

Author: Caball009

Generals/Code/GameEngine/Source/GameLogic/Object/Contain/OpenContain.cpp

@@ -234,6 +234,9 @@ void OpenContain::addOrRemoveObjFromWorld(Object* obj, Bool add)
 	}
 	else
 	{
+		DEBUG_ASSERTCRASH(!getObject()->isEffectivelyDead() && !getObject()->isDestroyed(),
+			("object shouldn't become an occupant of a dead or destroyed container object"));
+
 		// remove object from its group (if any)
 		obj->leaveGroup();
 
@@ -277,11 +280,26 @@ void OpenContain::addToContain( Object *rider )
 	if( rider == nullptr )
 		return;
 
+#if !RETAIL_COMPATIBLE_CRC
+	// TheSuperHackers @bugfix Caball009 25/05/2026 Ensure the occupant is only added to a non-destroyed
+	// container to avoid an invalid state and use-after-free bugs when accessing the contained by pointer.
+	if (getObject()->isDestroyed())
+	{
+		DEBUG_CRASH(("'%s' is about to be added to '%s', which is destroyed",
+			rider->getTemplate()->getName().str(), getObject()->getTemplate()->getName().str()));
+		return;
+	}
+#endif
+
 	// TheSuperHackers @bugfix Stubbjax 06/02/2026 Ensure the rider is not destroyed to prevent a
 	// likely crash if it enters the container on the same frame. If this occurs with an unpatched
 	// client present in a match, the game has a small chance to mismatch.
 	if (rider->isDestroyed())
+	{
+		DEBUG_CRASH(("'%s', which is destroyed, is about to be added to '%s'",
+			rider->getTemplate()->getName().str(), getObject()->getTemplate()->getName().str()));
 		return;
+	}
 
 #if defined(RTS_DEBUG)
 	if( !isValidContainerFor( rider, false ) )

Generals/Code/GameEngine/Source/GameLogic/Object/Contain/TransportContain.cpp

@@ -362,8 +362,19 @@ UpdateSleepTime TransportContain::update()
 {
 	const TransportContainModuleData *moduleData = getTransportContainModuleData();
 
-	if( m_payloadCreated == FALSE )
+	if (m_payloadCreated == FALSE)
+	{
+#if RETAIL_COMPATIBLE_CRC
 		createPayload();
+#else
+		// TheSuperHackers @bugfix Caball009 25/05/2026 Don't create payload
+		// for destroyed object to avoid leaving the payload in an invalid state.
+		if (!getObject()->isDestroyed())
+		{
+			createPayload();
+		}
+#endif
+	}
 
 	if( moduleData && moduleData->m_healthRegen )
 	{

GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Contain/OpenContain.cpp

@@ -241,6 +241,9 @@ void OpenContain::addOrRemoveObjFromWorld(Object* obj, Bool add)
 	}
 	else
 	{
+		DEBUG_ASSERTCRASH(!getObject()->isEffectivelyDead() && !getObject()->isDestroyed(),
+			("object shouldn't become an occupant of a dead or destroyed container object"));
+
 		// remove object from its group (if any)
 		obj->leaveGroup();
 
@@ -292,11 +295,26 @@ void OpenContain::addToContain( Object *rider )
 	if( rider == nullptr )
 		return;
 
+#if !RETAIL_COMPATIBLE_CRC
+	// TheSuperHackers @bugfix Caball009 25/05/2026 Ensure the occupant is only added to a non-destroyed
+	// container to avoid an invalid state and use-after-free bugs when accessing the contained by pointer.
+	if (getObject()->isDestroyed())
+	{
+		DEBUG_CRASH(("'%s' is about to be added to '%s', which is destroyed",
+			rider->getTemplate()->getName().str(), getObject()->getTemplate()->getName().str()));
+		return;
+	}
+#endif
+
 	// TheSuperHackers @bugfix Stubbjax 06/02/2026 Ensure the rider is not destroyed to prevent a
 	// likely crash if it enters the container on the same frame. If this occurs with an unpatched
 	// client present in a match, the game has a small chance to mismatch.
 	if (rider->isDestroyed())
+	{
+		DEBUG_CRASH(("'%s', which is destroyed, is about to be added to '%s'",
+			rider->getTemplate()->getName().str(), getObject()->getTemplate()->getName().str()));
 		return;
+	}
 
 	Drawable *riderDraw = rider->getDrawable();
 	Bool wasSelected = FALSE;

GeneralsMD/Code/GameEngine/Source/GameLogic/Object/Contain/TransportContain.cpp

@@ -469,8 +469,19 @@ UpdateSleepTime TransportContain::update()
 {
 	const TransportContainModuleData *moduleData = getTransportContainModuleData();
 
-	if( m_payloadCreated == FALSE )
+	if (m_payloadCreated == FALSE)
+	{
+#if RETAIL_COMPATIBLE_CRC
 		createPayload();
+#else
+		// TheSuperHackers @bugfix Caball009 25/05/2026 Don't create payload
+		// for destroyed object to avoid leaving the payload in an invalid state.
+		if (!getObject()->isDestroyed())
+		{
+			createPayload();
+		}
+#endif
+	}
 
 	if( moduleData && moduleData->m_healthRegen )
 	{