From f28d798073e571cb3114208cfa81653b9b502f6c Mon Sep 17 00:00:00 2001
From: Simon Howard
Date: Wed, 3 Jun 2015 20:20:37 -0400
Subject: Fix demo desyncs caused by P_RunThinkers() change.

1bcff874c52a changed the behavior of P_RunThinkers() to avoid
dereferencing thinker pointers after they had been freed, but the
modified version of the function was not logically equivalent to
Vanilla version, because the 'next' pointer can be changed by the
thinker function if one is invoked.

This fixes a desync in tnt-speed-movie-0443131.lmp. Thanks to Zvonimir
Bužanić for the bug report and Fabian Greffrath for reporting.

Fixes #547.
---
 src/doom/p_tick.c    | 4 ++--
 src/heretic/p_tick.c | 4 ++--
 src/hexen/p_tick.c   | 9 +++++----
 src/strife/p_tick.c  | 4 ++--
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/src/doom/p_tick.c b/src/doom/p_tick.c
index c933cfe9..5a93b80f 100644
--- a/src/doom/p_tick.c
+++ b/src/doom/p_tick.c
@@ -98,11 +98,10 @@ void P_RunThinkers (void)
     currentthinker = thinkercap.next;
     while (currentthinker != &thinkercap)
     {
-        nextthinker = currentthinker->next;
-
 	if ( currentthinker->function.acv == (actionf_v)(-1) )
 	{
 	    // time to remove it
+            nextthinker = currentthinker->next;
 	    currentthinker->next->prev = currentthinker->prev;
 	    currentthinker->prev->next = currentthinker->next;
 	    Z_Free(currentthinker);
@@ -111,6 +110,7 @@ void P_RunThinkers (void)
 	{
 	    if (currentthinker->function.acp1)
 		currentthinker->function.acp1 (currentthinker);
+            nextthinker = currentthinker->next;
 	}
 	currentthinker = nextthinker;
     }
diff --git a/src/heretic/p_tick.c b/src/heretic/p_tick.c
index 323cc1e6..ac1c9429 100644
--- a/src/heretic/p_tick.c
+++ b/src/heretic/p_tick.c
@@ -115,10 +115,9 @@ void P_RunThinkers(void)
     currentthinker = thinkercap.next;
     while (currentthinker != &thinkercap)
     {
-        nextthinker = currentthinker->next;
-
         if (currentthinker->function == (think_t) - 1)
         {                       // time to remove it
+            nextthinker = currentthinker->next;
             currentthinker->next->prev = currentthinker->prev;
             currentthinker->prev->next = currentthinker->next;
             Z_Free(currentthinker);
@@ -127,6 +126,7 @@ void P_RunThinkers(void)
         {
             if (currentthinker->function)
                 currentthinker->function(currentthinker);
+            nextthinker = currentthinker->next;
         }
         currentthinker = nextthinker;
     }
diff --git a/src/hexen/p_tick.c b/src/hexen/p_tick.c
index c58d6e82..3d3dd389 100644
--- a/src/hexen/p_tick.c
+++ b/src/hexen/p_tick.c
@@ -91,17 +91,18 @@ static void RunThinkers(void)
     currentthinker = thinkercap.next;
     while (currentthinker != &thinkercap)
     {
-        nextthinker = currentthinker->next;
-
         if (currentthinker->function == (think_t) - 1)
         {                       // Time to remove it
+            nextthinker = currentthinker->next;
             currentthinker->next->prev = currentthinker->prev;
             currentthinker->prev->next = currentthinker->next;
             Z_Free(currentthinker);
         }
-        else if (currentthinker->function)
+        else
         {
-            currentthinker->function(currentthinker);
+            if (currentthinker->function)
+                currentthinker->function(currentthinker);
+            nextthinker = currentthinker->next;
         }
 
         currentthinker = nextthinker;
diff --git a/src/strife/p_tick.c b/src/strife/p_tick.c
index c0dd4786..3c6caa06 100644
--- a/src/strife/p_tick.c
+++ b/src/strife/p_tick.c
@@ -104,11 +104,10 @@ void P_RunThinkers (void)
     currentthinker = thinkercap.next;
     while (currentthinker != &thinkercap)
     {
-        nextthinker = currentthinker->next;
-
         if ( currentthinker->function.acv == (actionf_v)(-1) )
         {
             // time to remove it
+            nextthinker = currentthinker->next;
             currentthinker->next->prev = currentthinker->prev;
             currentthinker->prev->next = currentthinker->next;
             Z_Free (currentthinker);
@@ -117,6 +116,7 @@ void P_RunThinkers (void)
         {
             if (currentthinker->function.acp1)
                 currentthinker->function.acp1 (currentthinker);
+            nextthinker = currentthinker->next;
         }
 
         currentthinker = nextthinker;
-- 
cgit v1.2.3