Destroyed Troop Crawler from reinforcement pad may crash the game due to use-after-free bug

[Caball009]

It'd appear that #2219 introduced a way to crash the game in headless mode.

05-59-43_2v4_01_0_HardAI_HardAI_HardAI_HardAI.zip

This replay crashes most of the time, but not every time, with the 2026-03-06 weekly release. I ran 12 instances in parallel and 11 instances crashed and 1 succeeded. With #2219 reverted the current main branch was successful 12 out of 12 times.

[Caball009]

I was able to find out what's going on this replay and #2219 is unrelated.

This issue #2741 can cause use-after-free bugs, because the Mini-Gunner infantry holds on to the pointer of the object that was supposed to contain them (i.e. the Trooper Crawler, which has been destroyed).

Reproduction is rather convoluted (requires debugging / temporary code changes):

1. Start new game as Infantry General and choose a map with a reinforcement pad.
2. Capture pad and destroy reinforcement plane before the reinforcement drop occurs. Next steps will probably be easier with the pad destroyed.
3. Pay attention to the destroyed Troop Crawler Object pointer, and keep producing empty container objects (Helix should be fine) until the memory is reused.
4. Make sure that the new object is a container object (has a non-zero Object::m_contain pointer).
5. Destroy the object to destruct OpenContain::m_containList. Make sure that the object destruction doesn't reuse the memory right away for a non-container object.
6. Surrender / end match -> game should crash. The crash is likely non-deterministic, though, because it depends on the 'severity' of use-after-free.

Here's a replay and custom map for VS22 that shows the crash in action:
vs22_replay_and_map.zip