Welcome to ZDF!

No, Canvas is a collection of engine managed objects. One for each canvas texture in the map.

If I read the Destroy function correctly (been some days ago I looked at it - could be wrong), OnDestroy is called before it marks it for destruction so as long as it doesn't get further everything is still in a sane state.

Then done with I_Error, this can be closed as suggested.

The canvas management is one big mess.
They are held in a static array that is never cleared, so they only get collected when the object system is shut down and the scripted OnDestroy method not called anymore. Should anything change here the error will be thrown in the regular destruction process.

This will also cause problems with the 'restart' CCMD, which should clear the AllCanvases array.

The lifetime of the canvases is tied to the lifetime of textures/textureids in the texture manager. The code was written under the assumption that the texture manager's texture list is static. If 'restart' reinitializes the texture manager then it should indeed need to be cleared at that point.

About changed OnDestroyed behavior in the engine, then yes throwing an exception here will break, but then what alternative is there really?

Are there any global variables that reliably track the engine's "I'm-not-reading-script-code" state that can be used in this case to allow OnDestroy to function as normal?

Would adding the function override to the Canvas class in ZScript as a "final" instead be a viable alternative?