fix data race in ship-ship collision submodel checking

ship_ship_check_collision() toggled pmi->submodel[].collision_checked
flags on the heavy ship's polymodel_instance to selectively enable/
disable submodel collision checks. When two collision pairs shared the
same heavy ship, worker threads would race on the same pmi entries.

Fix: add a collision_checked_override pointer to mc_info that lets
callers provide a thread-local array of collision_checked values.
model_collide() uses the override when set, falling back to the
pmi->submodel[] field otherwise. ship_ship_check_collision() now
builds a local SCP_vector<char> and passes it via the override,
completely avoiding writes to shared polymodel_instance state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Goober5000

code/model/model.h

@@ -1282,6 +1282,12 @@ typedef struct mc_info {
 	float   radius = 0;                 // If MC_CHECK_THICK is set, checks a sphere moving with the radius.
 	int     lod = 0;                    // Which detail level of the submodel to check instead
 
+	// Optional per-submodel collision_checked override array (indexed by submodel number).
+	// When non-null, model_collide uses this instead of pmi->submodel[].collision_checked,
+	// allowing callers to control which submodels are skipped without writing to shared state.
+	// This is essential for thread-safe ship-ship collision detection.
+	const char *collision_checked_override = nullptr;
+
 	// Return values
 	int     num_hits = 0;               // How many collisions were found
 	float   hit_dist = 0.0f;            // The distance from p0 to hitpoint

code/model/modelcollide.cpp

@@ -1098,7 +1098,7 @@ void mc_check_subobj( int mn )
 			vm_vec_add2(&instance_offset, &csmi->canonical_offset);
 
 			blown_off = csmi->blown_off;
-			collision_checked = csmi->collision_checked;
+			collision_checked = Mc->collision_checked_override ? Mc->collision_checked_override[i] : csmi->collision_checked;
 		}
 
 		// Don't check it or its children if it is destroyed

code/object/collideshipship.cpp

@@ -259,29 +259,34 @@ int ship_ship_check_collision(collision_info_struct *ship_ship_hit_info)
 			SCP_vector<int> submodel_vector;
 			model_get_moving_submodel_list(submodel_vector, heavy_obj);
 
+			// Build a local collision_checked override array so we don't write to shared pmi state.
+			// This is essential for thread safety when multiple pairs share the same heavy ship.
+			SCP_vector<char> collision_checked_local(pm->n_models, 0);
+			for (int j = 0; j < pm->n_models; j++) {
+				collision_checked_local[j] = pmi->submodel[j].collision_checked;
+			}
+
 			// turn off all moving submodels, collide against only 1 at a time.
-			// turn off collision detection for all moving submodels
 			for (auto submodel : submodel_vector) {
-				pmi->submodel[submodel].collision_checked = true;
+				collision_checked_local[submodel] = true;
 			}
 
 			// Only check single submodel now, since children of moving submodels are handled as moving as well
 			mc.flags = orig_flags | MC_SUBMODEL;
+			mc.collision_checked_override = collision_checked_local.data();
 
 			if (heavy_sip->collision_lod > -1) {
 				mc.lod = heavy_sip->collision_lod;
 			}
 
 			// check each submodel in turn
 			for (auto submodel : submodel_vector) {
-				auto smi = &pmi->submodel[submodel];
-
 				// turn on just one submodel for collision test
-				smi->collision_checked = false;
+				collision_checked_local[submodel] = false;
 
-				if (smi->blown_off)
+				if (pmi->submodel[submodel].blown_off)
 				{
-					smi->collision_checked = true;
+					collision_checked_local[submodel] = true;
 					continue;
 				}
 
@@ -315,8 +320,13 @@ int ship_ship_check_collision(collision_info_struct *ship_ship_hit_info)
 						model_instance_local_to_global_point(&ship_ship_hit_info->light_collision_cm_pos, &int_light_pos, pm, pmi, mc.hit_submodel, &heavy_obj->orient, &zero);
 					}
 				}
+
+				// re-disable this submodel before enabling the next one
+				collision_checked_local[submodel] = true;
 			}
 
+			// Clear the override before subsequent model_collide calls
+			mc.collision_checked_override = nullptr;
 		}
 
 		// Now complete base model collision checks that do not take into account rotating submodels.