* avoid undefined behavior from UNREACHABLE on reachable code paths
UNREACHABLE expands to __assume(false) / __builtin_unreachable() in
release builds, which is undefined behavior if the code is ever actually
reached. Many UNREACHABLE sites only guard against unexpected-but-
possible runtime states (values from tables, mission/save files, network
packets, scripting, or user input), so reaching them should degrade
gracefully rather than invoke UB.
Replace UNREACHABLE with Assertion(false, ...) at all such sites. It
still pops an error in debug builds, but in release it is a harmless
no-op that simply falls through to the following code. Sites that are
genuinely unreachable by local invariants (e.g. a switch over a bounded
random number) are left as UNREACHABLE.
A few converted sites had no safe fall-through -- an uninitialized read,
null dereference, or null call would have followed -- so they also get a
minimal recovery: initialize the value, guard the dereference, return
early, or skip the offending item.
Where the converted site was a simple guard of the form
if (x) { Assertion(false, ...); return; }
hoist the check onto the invariant instead:
Assertion(!x, ...);
if (x) { return; }
This states the expectation directly and shows the offending value in
the debug popup, while keeping the same graceful runtime degradation.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
* addendum
After consultation with Lafiel, use UNREACHABLE in situations that are effectively impossible even if not provably impossible. UNREACHABLE = "this shouldn't ever happen"; Assertion = "if this ever happens, it's a coding error". Also fix a few other sites and change a couple to Warnings.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
Rewrite `force_fit_string` to be more robust and to remove the potential for memory access violations. Also audit all of the length parameters in the calling functions - some of them were the buffer size, not the length. This should fix the mysterious crash in the mission log screen.
* Allow defining separate player and target shield icons for config
* rename define to prevent confusion with a similar define in shield.cpp
* address some feedback
* base working version
* localization and minor tweaks
* add retail UI controls
* Add way to hide gauges from Config view
* convert hud config from index matching to id matching
* clang
* Add scaling for vfnts and scale multipler to gr_string
* nullptr
* Add scaling to a couple other string operations
* Add scaling features to additional bitmap drawing methods
* Implement framework for rendering hud gauges in config mode
* fix merge error
* address feedback
As a follow-up to #5523, some mods use callsigns for their ships but prefer not to display the callsigns in the escort list. In lieu of a more flexible way to configure escort lists, a simple flag is sufficient to implement the desired behavior.
In #5477, I made the escort list respect hidden names by copying the behavior from `message_queue_process()`, which already checked those flags; however, this resulted in some dramatic behavioral changes for mods using callsigns for escort ships, and while making the behavior optional was a possibility, feedback suggested everyone would rather it just behaved like the target box and displayed both. So I replaced the code with similar logic from hudtargetbox.cpp, except with the "replace hidden name with ship class" code taking priority.
When iterating through `Ship_obj_list`, check the `Should_be_dead` flag before using the object. This fixes#4990 and adds defense-in-depth checks to guard against similar errors elsewhere.
I considered moving the `Ship_obj_list` removal from `obj_delete` to `ship_cleanup`, but decided it would be prudent to avoid fundamental changes to lifecycle management.
* refactor hud escort list to be less crazy
- don't keep rebuilding list
- add and remove ships more efficiently
- better handling of player ships in multi (fixes#1674)
* fix sorting issues
- incomplete priority sort
- reversed alpha sort
* fix additional sorting issue
* improve safety check in list sort function
* add safety checks to hud_add_ship_to_escort()
this wasn't meant to be used outside of the module so
it was not really safe to use with sexps previously
* remove entries properly in hud_add_remove_ship_escort()
Several things going on here:
1) refactor `get_display_string()` to `get_display_name()` to be more precise
2) likewise, refactor `alt_name` to `display_name`
3) automatically generate display names when parsing the ship, ship class, and weapon class for the first time
4) remove the on-the-fly truncation of names with hash symbols
Basically this subsumes the `end_string_at_first_hash_symbol` logic into the display name. Rather than truncate the name every time it's displayed, truncate it once when it's parsed. This takes advantage of the previous display name infrastructure, since display names are a superset of the case of truncating the hash symbol.
This also has the benefit of now allowing hash symbols within display names. When updating Destiny of Peace, I noticed that "Lockheed Shuttle #4" would no longer display properly; and it was not previously possible to fix this even with display names.
I could pull out the `get_display_string()` and `alt_name` renaming into a separate PR if desired.
Removed a lot of unused functions.
This is mostly a cleanup of a prior refactoring.
There where a lot of unimplemented functions remaining from renaming.
Removed several outcommented parts of code.
This adds a mission file option for ships which allows specifying a
different string which should be used for displaying the name of the
ship to the user. This name will not be used in SEXPs or other ship
lookup functions so it can be freely translated and two ships can also
have the same display name.
The new feature can be used by adding $Display name: <string> after $Name
for a ship in a mission file. I think I added proper support for FRED
(and qtFRED) so that this new value is properly saved but it would be
great if someone could test that.
This implements one of the features requested in #1730.
This adds a new class which allows to create type safe resource handle
types. At the moment, the engine uses ints pretty much everywhere for
providing handles to resources created by the specific subsystems. Since
all ints are the same to the C/C++ typesystem it is perfectly legal to
pass a sound handle to the graphics API as a buffer handle which will
obviously cause issues.
This adds a new type called "ID" which is a wrapper class for a generic
handle but with added type safety. An instance of this class cannot be
passed to a function expecting another type of handle which provided
compile-time type safety for these APIs.
As an initial test I converted the game sound handles to this new type.
I already found a bug in the mainhall system thanks to this new type.
The mainhall used the game sound handles as sound instance handles which
probably meant that that specific code never really worked right. I
removed the code since there was no better alternative for fixing it.
This introduces a new mechanism for handling bit flags. Instead of using an int (or two, or three) to write bits into, this uses the std::bitset in a wrapper class that accepts an enum class as input. This means that certain classes of errors we've had a few of in the engine, where a coder used the wrong set of flags or checked them against the wrong variable (SF_STEALTH vs SIF_STEALTH, for example) can now be detected at a compiler level rather than not at all.
This allows to use standard TrueType Fonts for text rendering in FSO. It uses the NanoVG library which provides the ability of drawing 2D shapes. This library is used for most 2D operations now and can also be used directly by using the PathRenderer class.
It allows the escort gauge to render with ship names right-aligned, as the name would suggest. Changed gr_force_fit_string() to return the width instead redundantly returning the (already modified in-place) string; nothing else actually cares about the return value, so secondary impact should be nonexistent.
