Infinite loop in PhysDestroyObject

[Alienmario]

server_srv.so!PhysDestroyObject passing a CBaseEntity pointer into vphysics function RemoveAllPairsForObject sometimes causes an infinite loop.

A workaround by @ReservedRegister suggests removing the call for the entity pointer, only leaving the call for IPhysicsObject.

This may create a leak of sorts, however that should only last up to a level change.

https://crash.limetech.org/bjcuvmkeib52

0	engine_srv.so!Sys_Error_Internal(bool, char const*, char*) + 0x1b5
1	engine_srv.so!Sys_Error(char const*, ...) + 0x20
2	engine_srv.so!Host_Error(char const*, ...) + 0xde
3	engine_srv.so!WatchDogHandler() + 0x20
4	libtier0_srv.so!WatchDogHandler(int) + 0x35
5	linux-gate.so + 0xdb0
6	vphysics_srv.so!CObjectPairHash::RemoveAllPairsForObject(void*) + 0x20b
7	server_srv.so!PhysDestroyObject(IPhysicsObject*, CBaseEntity*) + 0x92
8	server_srv.so!CBaseEntity::VPhysicsDestroyObject() + 0x3a
9	server_srv.so!CBaseEntity::UpdateOnRemove() + 0xb6
10	server_srv.so!CXenGruntPod::UpdateOnRemove() + 0x3d
11	server_srv.so!UTIL_Remove(IServerNetworkable*) + 0x5a
12	server_srv.so!CBaseEntity::InputKill(inputdata_t&) + 0x46
13	server_srv.so!CBaseEntity::AcceptInput(char const*, CBaseEntity*, CBaseEntity*, variant_t, int) + 0x5ae
14	server_srv.so!CEventQueue::ServiceEvents() + 0x261
15	server_srv.so!ServiceEventQueue() + 0x37
16	server_srv.so!CServerGameDLL::GameFrame(bool) + 0x172
17	sourcemod.2.bms.so!__SourceHook_FHCls_IServerGameDLLGameFramefalse::Func(bool) [sourcemod.cpp:54 + 0x14]
18	engine_srv.so!CServerPlugin::GameFrame(bool) + 0x77
19	engine_srv.so!SV_Think(bool) + 0xcc
20	engine_srv.so!SV_Frame(bool) + 0xfe
21	engine_srv.so!_Host_RunFrame_Server(bool) + 0x71
22	engine_srv.so!_Host_RunFrame(float) + 0x2d1
23	engine_srv.so!CHostState::State_Run(float) + 0x11c
24	engine_srv.so!CHostState::FrameUpdate(float) + 0x186
25	engine_srv.so!HostState_Frame(float) + 0x2b
26	engine_srv.so!CEngine::Frame() + 0x552
27	engine_srv.so!CDedicatedServerAPI::RunFrame() + 0x33
28	dedicated_srv.so!RunServer() + 0x53
29	dedicated_srv.so!CDedicatedExports::RunServer() + 0x17
30	engine_srv.so!CModAppSystemGroup::Main() + 0xbe
31	engine_srv.so!CAppSystemGroup::Run() + 0x58
32	engine_srv.so!CDedicatedServerAPI::ModInit(ModInfo_t&) + 0x247
33	dedicated_srv.so!CDedicatedAppSystemGroup::Main() + 0xa5
34	dedicated_srv.so!CAppSystemGroup::Run() + 0x58
35	dedicated_srv.so!CSteamApplication::Main() + 0x37
36	dedicated_srv.so!CAppSystemGroup::Run() + 0x58
37	dedicated_srv.so!main + 0x1f8
38	dedicated_srv.so!DedicatedMain + 0x24
39	srcds_linux!main + 0x2b8
40	libc-2.31.so!__libc_start_main + 0xf5
41	srcds_linux + 0xbd5
42	srcds_linux + 0x780
43	srcds_linux + 0xcb0
44	srcds_linux + 0xd20

0	engine_srv.so!Sys_Error_Internal(bool, char const*, char*) + 0x1b5
1	engine_srv.so!Sys_Error(char const*, ...) + 0x20
2	engine_srv.so!Host_Error(char const*, ...) + 0xde
3	engine_srv.so!WatchDogHandler() + 0x20
4	libtier0_srv.so!WatchDogHandler(int) + 0x35
5	linux-gate.so + 0xdb0
6	vphysics_srv.so!IVP_VHash_Store::find_elem(void*) + 0x5b
7	vphysics_srv.so!CObjectPairHash::RemoveAllPairsForObject(void*) + 0xdb
8	server_srv.so!PhysDestroyObject(IPhysicsObject*, CBaseEntity*) + 0x92
9	server_srv.so!CBaseEntity::VPhysicsDestroyObject() + 0x3a
10	server_srv.so!CBaseEntity::UpdateOnRemove() + 0xb6
11	server_srv.so!UTIL_Remove(IServerNetworkable*) + 0x5a
12	server_srv.so!CBaseEntity::SUB_FadeOut() + 0xc8
13	server_srv.so!CBaseEntity::Think() + 0x1c
14	server_srv.so!CBaseEntity::PhysicsDispatchThink(void (CBaseEntity::*)()) + 0xf3
15	server_srv.so!CBaseEntity::PhysicsRunSpecificThink(int, void (CBaseEntity::*)()) + 0xdd
16	server_srv.so!CBaseEntity::PhysicsRunThink(CBaseEntity::thinkmethods_t) [clone .part.143] + 0x35
17	server_srv.so!CBaseEntity::PhysicsNone() + 0x40
18	server_srv.so!CBaseEntity::PhysicsSimulate() + 0xa1
19	server_srv.so!Physics_SimulateEntity(CBaseEntity*) + 0x2bb
20	server_srv.so!Physics_RunThinkFunctions(bool) + 0x1e4
21	server_srv.so!CServerGameDLL::GameFrame(bool) + 0x168

0	engine_srv.so!Sys_Error_Internal(bool, char const*, char*) + 0x1b5
1	engine_srv.so!Sys_Error(char const*, ...) + 0x20
2	engine_srv.so!Host_Error(char const*, ...) + 0xde
3	engine_srv.so!WatchDogHandler() + 0x20
4	libtier0_srv.so!WatchDogHandler(int) + 0x35
5	linux-gate.so + 0xdb0
6	vphysics_srv.so!IVP_VHash_Store::find_elem(void*) + 0x5b
7	vphysics_srv.so!CObjectPairHash::RemoveAllPairsForObject(void*) + 0xdb
8	server_srv.so!PhysDestroyObject(IPhysicsObject*, CBaseEntity*) + 0x92
9	server_srv.so!CBaseEntity::VPhysicsDestroyObject() + 0x3a
10	server_srv.so!CBaseEntity::UpdateOnRemove() + 0xb6
11	server_srv.so!UTIL_Remove(IServerNetworkable*) + 0x5a
12	server_srv.so!CBasePickup::PickupTouch(CBaseEntity*) + 0xf8
13	server_srv.so!CBaseEntity::Touch(CBaseEntity*) + 0x39
14	server_srv.so!CBaseEntity::PhysicsStartTouch(CBaseEntity*) + 0x42
15	server_srv.so!CBaseEntity::PhysicsMarkEntityAsTouched(CBaseEntity*) + 0x342
16	server_srv.so!CBaseEntity::PhysicsMarkEntitiesAsTouching(CBaseEntity*, CGameTrace&) + 0x14e
17	server_srv.so!CServerGameEnts::MarkEntitiesAsTouching(edict_t*, edict_t*) + 0xf2
18	engine_srv.so!SV_SolidMoved(edict_t*, ICollideable*, Vector const*, bool) + 0x4e3
19	engine_srv.so!CVEngineServer::SolidMoved(edict_t*, ICollideable*, Vector const*, bool) + 0x33
20	server_srv.so!CBaseEntity::PhysicsTouchTriggers(Vector const*) + 0x15d
21	server_srv.so!CMoveHelperServer::ProcessImpacts() + 0x2a
22	server_srv.so!CPlayerMove::RunCommand(CBasePlayer*, CUserCmd*, IMoveHelper*) + 0x6e4
23	server_srv.so!CBasePlayer::PlayerRunCommand(CUserCmd*, IMoveHelper*) + 0x1cb
24	server_srv.so!CBlackMesaPlayer::PlayerRunCommand(CUserCmd*, IMoveHelper*) + 0x5f
25	sdktools.ext.2.bms.so!__SourceHook_MFHCls_PlayerRunCmdHook::Func(CUserCmd*, IMoveHelper*) [hooks.cpp:53 + 0x12]
26	server_srv.so!CBasePlayer::PhysicsSimulate() + 0x4c9
27	server_srv.so!Physics_SimulateEntity(CBaseEntity*) + 0x2bb
28	server_srv.so!Physics_RunThinkFunctions(bool) + 0x1e4
29	server_srv.so!CServerGameDLL::GameFrame(bool) + 0x168

[Alienmario]

Also had this happen in HL2DM, even though it's rare.

0	engine_srv.so!Sys_Error_Internal(bool, char const*, char*) + 0x13b
1	engine_srv.so!Sys_Error(char const*, ...) + 0x20
2	engine_srv.so!Host_Error(char const*, ...) + 0xa4
3	engine_srv.so!WatchDogHandler() + 0x12
4	linux-gate.so + 0x560
5	server_srv.so!PhysDestroyObject(IPhysicsObject*, CBaseEntity*) + 0x6e
6	server_srv.so!CBaseEntity::VPhysicsDestroyObject() + 0x34
7	server_srv.so!CBaseEntity::UpdateOnRemove() + 0x9d
8	server_srv.so!CBaseCombatCharacter::UpdateOnRemove() + 0xca
9	server_srv.so!CAI_BaseNPC::UpdateOnRemove() + 0x41
10	server_srv.so!CNPC_Manhack::UpdateOnRemove() + 0x31
11	server_srv.so!UTIL_Remove(IServerNetworkable*) + 0x69
12	server_srv.so!UTIL_Remove(CBaseEntity*) + 0x19
13	server_srv.so!CAI_BaseNPC::Event_Gibbed(CTakeDamageInfo const&) + 0x65
14	server_srv.so!CBaseCombatCharacter::OnTakeDamage(CTakeDamageInfo const&) + 0x271
15	sdkhooks.ext.2.hl2dm.so!__SourceHook_MFHCls_OnTakeDamage::Func(CTakeDamageInfoHack&) [extension.cpp:169 + 0x14] 
16	server_srv.so!CBaseEntity::TakeDamage(CTakeDamageInfo const&) + 0x297
17	server_srv.so!ApplyMultiDamage() + 0x96
18	server_srv.so!CGameRules::RadiusDamage(CTakeDamageInfo const&, Vector const&, float, int, CBaseEntity*) + 0x13fe
19	server_srv.so!RadiusDamage(CTakeDamageInfo const&, Vector const&, float, int, CBaseEntity*) + 0x36
20	server_srv.so!CBaseGrenade::Explode(CGameTrace*, int) + 0x447
21	server_srv.so!CBaseGrenade::Detonate() + 0x2b6
22	server_srv.so!CGrenadeFrag::DelayThink() + 0xd3
23	server_srv.so!CBaseEntity::Think() + 0x24
24	server_srv.so!CBaseEntity::PhysicsDispatchThink(void (CBaseEntity::*)()) + 0x11b
25	server_srv.so!CBaseEntity::PhysicsRunSpecificThink(int, void (CBaseEntity::*)()) + 0xdd
26	server_srv.so!CBaseEntity::PhysicsRunThink(CBaseEntity::thinkmethods_t) + 0x6a
27	server_srv.so!CBaseEntity::PhysicsNone() + 0x33
28	server_srv.so!CBaseEntity::PhysicsSimulate() + 0x1c5
29	server_srv.so!Physics_SimulateEntity(CBaseEntity*) + 0x254
30	server_srv.so!Physics_RunThinkFunctions(bool) + 0x21b
31	server_srv.so!CServerGameDLL::GameFrame(bool) + 0x19a