ZDoom

Superb work as usual. :) I've just ported the fix to LZDoom.

Well, this means my commit comments really suck.

[url=https://github.com/coelckers/gzdoom/blob/d5ff2746be69636ed17c197877407ee2ad12b8f7/src/scripting/vmiterators.cpp#L95]DBlockLinesIterator[/url] was derived from [url=https://github.com/coelckers/gzdoom/blob/7351a76404dc59b18681f4ac96249e39666b170e/src/playsim/p_maputl.h#L231]FMultiBlockLinesIterator[/url].
[url=https://github.com/coelckers/gzdoom/blob/d5ff2746be69636ed17c197877407ee2ad12b8f7/src/scripting/vmiterators.cpp#L98]DBlockLinesIterator::check[/url] was passed to [url=https://github.com/coelckers/gzdoom/blob/d5ff2746be69636ed17c197877407ee2ad12b8f7/src/scripting/vmiterators.cpp#L112]FMultiBlockLinesIterator's constructor[/url] while it wasn't initialized because parent class' constructor is called before all members' constructors.
The problem was [url=https://github.com/coelckers/gzdoom/blob/7351a76404dc59b18681f4ac96249e39666b170e/src/playsim/p_maputl.cpp#L724]FMultiBlockLinesIterator's constructor[/url] is using its [b]check[/b] argument.
For this reason, [b]DBlockLinesIterator[/b] cannot be derived from [b]FMultiBlockLinesIterator[/b]. It should be made a member initialized after [b]check[/b].

Out of curiosity, why does this kind of change help fix it?

Fixed in [url=https://github.com/coelckers/gzdoom/commit/fb384c6b8da01c54ec491a8e7dd778718187b7f7]fb384c6[/url].

Sorry for the bump, but I have some more important, bump-worthy (IMO) info to add:
So it turns out it's even weirder. For some reason, portals combined with polyobjects and BlockLinesIterator causes heap corruption. Unfortunately, this seems to be something I can't figure out how to fix myself.

Okay, so, it's definitely something to do with portals. I took a moment to look at the callstack, and then it was pretty obvious:
[imgur]https://imgur.com/AzyCrIN[/imgur]
Seems like the "data" TArray in [url=https://github.com/coelckers/gzdoom/blob/2a16fb9d28cc1750cf53baedb0135c7ef41fff72/src/playsim/p_maputl.h#L147]here[/url] may not be getting initialized.

Basically what it says in the thread title. Not sure what causes it. I haven't found many maps that cause it, only [url=https://github.com/Doom2fan/Se7evidas/blob/master/Editing/Addons/Maps/Training%20map/Range.wad]the WIP training map for my mod[/url]. [url=https://github.com/Doom2fan/Se7evidas]My mod[/url]'s radar (use "give all" to get it) seems to cause it reliably, though the moment it happens is random.
I don't have a minimal example right now, but I'll try to make one as soon as I figure out what in the map causes it.

Edit: Just speculation, but it [i]might[/i] be related to portals. Would explain why I hadn't found the crash when testing in the IWAD maps.

Edit 2: Added a simpler BlockLinesIterator example as an attachment. I also tried to make a simpler map, but couldn't get it to crash reliably.

Edit 3: Updated the thread title. This is nastier than I thought.
Edit 3.1: Updated the thread title to add the first version I can find this in. [i]Uhhhhhhhhh[/i].

Edit 4: Updated the thread title again and added a fully minimal example.