Fix SA crash @ 0x0116C9C5 (CTxdStore::GetTxd_0). There was prior fixes for this crash offset, but they didn't fix all cases/paths.

Author: Dutchman101

Client/game_sa/CModelInfoSA.cpp

@@ -608,7 +608,8 @@ void CModelInfoSA::Remove()
     // Remove our reference
     if (m_pInterface->usNumberOfRefs > 0)
     {
-        if (CTxdStore_GetTxd(m_pInterface->usTextureDictionary) != nullptr)
+        if (pGame && !pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(m_pInterface->usTextureDictionary) &&
+            CTxdStore_GetTxd(m_pInterface->usTextureDictionary) != nullptr)
             CTxdStore_RemoveRef(m_pInterface->usTextureDictionary);
         m_pInterface->usNumberOfRefs--;
     }
@@ -1104,6 +1105,10 @@ void CModelInfoSA::SetTextureDictionaryID(unsigned short usID)
     if (usOldTxdId == usID)
         return;
 
+    // CTxdStore functions (GetTxd, AddRef, RemoveRef) crash on free pool entries.
+    if (!pGame || pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(usID))
+        return;
+
     // Slot allocated (e.g. via engineRequestTXD) but TXD data isn't loaded yet.
     // For unloaded models without geometry, record the new TXD ID and transfer
     // entity refs so callers' pre-added refs are consumed. Loaded models fall
@@ -1113,9 +1118,6 @@ void CModelInfoSA::SetTextureDictionaryID(unsigned short usID)
     // texture data arrives later via engineImageLinkTXD + restream.
     if (CTxdStore_GetTxd(usID) == nullptr)
     {
-        if (!pGame || pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(usID))
-            return;
-
         if (!m_pInterface->pRwObject)
         {
             if (!MapContains(ms_DefaultTxdIDMap, static_cast<unsigned short>(m_dwModelID)))
@@ -1131,7 +1133,7 @@ void CModelInfoSA::SetTextureDictionaryID(unsigned short usID)
             for (size_t i = 0; i < referencesCount; i++)
                 CTxdStore_AddRef(usID);
 
-            if (CTxdStore_GetTxd(usOldTxdId) != nullptr)
+            if (!pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(usOldTxdId) && CTxdStore_GetTxd(usOldTxdId) != nullptr)
             {
                 for (size_t i = 0; i < referencesCount; i++)
                     CTxdStore_RemoveRef(usOldTxdId);
@@ -1196,9 +1198,9 @@ void CModelInfoSA::SetTextureDictionaryID(unsigned short usID)
         }
     }
 
-    // Release old TXD refs after rebinding completes
-    // Only release if old slot is still valid to avoid crash on stale/orphaned TXD slots
-    if (CTxdStore_GetTxd(usOldTxdId) != nullptr)
+    // Release old TXD refs after rebinding. Skip if the slot was freed between
+    // capturing usOldTxdId and here - CTxdStore functions crash on free entries.
+    if (!pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(usOldTxdId) && CTxdStore_GetTxd(usOldTxdId) != nullptr)
     {
         for (size_t i = 0; i < referencesCount; i++)
             CTxdStore_RemoveRef(usOldTxdId);
@@ -2198,7 +2200,8 @@ void CModelInfoSA::ResetVehicleDummies(bool bRemoveFromDummiesMap)
         {
             if (pVehicleModel && pVehicleModel->usNumberOfRefs > 0)
             {
-                if (CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
+                if (pGame && !pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(pVehicleModel->usTextureDictionary) &&
+                    CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
                     CTxdStore_RemoveRef(pVehicleModel->usTextureDictionary);
                 pVehicleModel->usNumberOfRefs--;
             }
@@ -2215,7 +2218,8 @@ void CModelInfoSA::ResetVehicleDummies(bool bRemoveFromDummiesMap)
 
     if (pVehicleModel->usNumberOfRefs > 0)
     {
-        if (CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
+        if (pGame && !pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(pVehicleModel->usTextureDictionary) &&
+            CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
             CTxdStore_RemoveRef(pVehicleModel->usTextureDictionary);
         pVehicleModel->usNumberOfRefs--;
     }
@@ -2246,7 +2250,8 @@ void CModelInfoSA::ResetAllVehicleDummies()
             {
                 if (pVehicleModel && pVehicleModel->usNumberOfRefs > 0)
                 {
-                    if (CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
+                    if (pGame && !pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(pVehicleModel->usTextureDictionary) &&
+                        CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
                         CTxdStore_RemoveRef(pVehicleModel->usTextureDictionary);
                     pVehicleModel->usNumberOfRefs--;
                 }
@@ -2260,7 +2265,8 @@ void CModelInfoSA::ResetAllVehicleDummies()
 
         if (pVehicleModel->usNumberOfRefs > 0)
         {
-            if (CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
+            if (pGame && !pGame->GetPools()->GetTxdPool().IsFreeTextureDictonarySlot(pVehicleModel->usTextureDictionary) &&
+                CTxdStore_GetTxd(pVehicleModel->usTextureDictionary) != nullptr)
                 CTxdStore_RemoveRef(pVehicleModel->usTextureDictionary);
             pVehicleModel->usNumberOfRefs--;
         }