npc_destroy: Defer NPC destruction via timer

055-1 _nodes.txt will call `destroy;` from within OnInit, that is during an
iteration of the global `ev_db`. Previously, concurrent modification
invalidated this iteration, resulting in a crash.

This still nullifes `oid`, dequeues all timers, and effectively calls
`builtin_end`.

`npc_data::deletion_pending` is extended to include a third state.
In addition to no deletion happening, and indicating when `npc_free` is
currently on the stack, it now also tracks whether the NPC is about to be
deleted by a timer.

This means that an NPC which is about to be deleted is still blocked from
triggering new events, much like an NPC actively being deleted would.

Starting or continuing an NPC dialog with an NPC that does not, or is about to
no longer exist, is now also blocked.

1 files changed, 13 insertions, 2 deletions

diff --git a/src/map/script-fun.cpp b/src/map/script-fun.cpp
index 0014805..13b4bc8 100644
--- a/src/map/script-fun.cpp
+++ b/src/map/script-fun.cpp
@@ -1283,8 +1283,19 @@ void builtin_destroy(ScriptState *st)
         npc_event_dequeue(sd);
     }
 
+    // Cancel all existing timers on the NPC.
+    // They "would" never fire, and we don't want race conditions here.
+    for (int i = 0; i < MAX_EVENTTIMER; i++)
+    {
+        nd->eventtimer[i].cancel();
+    }
+    // Schedule the NPC to be freed on the next available tick.
+    // Scripts can be invoked under iteration of the ev_db global event
+    // database, and we don't want to invalidate active iterators.
+    nd->deletion_pending = npc_data::DELETION_QUEUED;
+    nd->eventtimer[0] = Timer(gettick(), std::bind(npc_free, nd));
+
     nd = nd->is_script();
-    npc_free(nd);
     st->oid = BlockId();
 
     if (!HARG(0))
@@ -1350,7 +1361,7 @@ void builtin_puppet(ScriptState *st)
     nd->npc_subtype = NpcSubtype::SCRIPT;
     npc_script++;
 
-    nd->deletion_pending = false;
+    nd->deletion_pending = npc_data::NOT_DELETING;
 
     nd->n = map_addnpc(nd->bl_m, nd);