From 3834d30ab6e1cbc717760419582cad8642590232 Mon Sep 17 00:00:00 2001
From: githubawn <115191165+githubawn@users.noreply.github.com>
Date: Thu, 2 Apr 2026 23:03:46 +0200
Subject: [PATCH 1/3] Fix W3DTreeBuffer crash due to stale vertex buffer
 indices

---
 .../Source/W3DDevice/GameClient/W3DTreeBuffer.cpp     | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
index 7f951c7f908..532761f4d90 100644
--- a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
+++ b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
@@ -709,6 +709,10 @@ void W3DTreeBuffer::loadTreesInVertexAndIndexBuffers(RefRenderObjListIterator *p
 	Int curTree=0;
 	Int bNdx;
 	const GlobalData::TerrainLighting *objectLighting = TheGlobalData->m_terrainObjectsLighting[TheGlobalData->m_timeOfDay];
+	// TheSuperHackers @info Reset bufferNdx so updateVertexBuffer skips trees absent from this rebuild.
+	for (Int t = 0; t < m_numTrees; t++) {
+		m_trees[t].bufferNdx = -1;
+	}
 	for (bNdx=0; bNdx<MAX_BUFFERS; bNdx++) {
 		m_curNumTreeVertices[bNdx] = 0;
 		m_curNumTreeIndices[bNdx] = 0;
@@ -991,6 +995,10 @@ void W3DTreeBuffer::updateVertexBuffer()
 		DX8VertexBufferClass::WriteLockClass lockVtxBuffer(m_vertexTree[bNdx], D3DLOCK_DISCARD);
 	#endif
 		vb=(VertexFormatXYZNDUV1*)lockVtxBuffer.Get_Vertex_Array();
+		// TheSuperHackers @info Guard against a failed vertex buffer lock returning null.
+		if (!vb) {
+			break;
+		}
 
 		VertexFormatXYZNDUV1 *curVb;
 
@@ -1012,8 +1020,9 @@ void W3DTreeBuffer::updateVertexBuffer()
 			Vector3 loc = m_trees[curTree].location;
 			Real theSin = m_trees[curTree].sin;
 			Real theCos = m_trees[curTree].cos;
+			// TheSuperHackers @info Skip missing mesh trees to avoid using the wrong vertex count.
 			if (type<0 || m_treeTypes[type].m_mesh == nullptr) {
-				type = 0;
+				continue;
 			}
 
 			Int startVertex = m_trees[curTree].firstIndex;

From f4077315e4c5753c2e2ca68874348f24f0f8f6dd Mon Sep 17 00:00:00 2001
From: githubawn <115191165+githubawn@users.noreply.github.com>
Date: Thu, 2 Apr 2026 23:14:24 +0200
Subject: [PATCH 2/3] implemented technically correct suggestion from greptile
 replaced break with continue

---
 .../Source/W3DDevice/GameClient/W3DTreeBuffer.cpp               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
index 532761f4d90..fbece6026f8 100644
--- a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
+++ b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
@@ -997,7 +997,7 @@ void W3DTreeBuffer::updateVertexBuffer()
 		vb=(VertexFormatXYZNDUV1*)lockVtxBuffer.Get_Vertex_Array();
 		// TheSuperHackers @info Guard against a failed vertex buffer lock returning null.
 		if (!vb) {
-			break;
+			continue;
 		}
 
 		VertexFormatXYZNDUV1 *curVb;

From f91ae50645c80acb21a566f8ec6d6e71a036e35f Mon Sep 17 00:00:00 2001
From: githubawn <115191165+githubawn@users.noreply.github.com>
Date: Sun, 5 Apr 2026 03:46:28 +0200
Subject: [PATCH 3/3] implemented review feedback

---
 .../W3DDevice/GameClient/W3DTreeBuffer.cpp    | 24 ++++++-------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
index fbece6026f8..aa86abc5f2a 100644
--- a/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
+++ b/Core/GameEngineDevice/Source/W3DDevice/GameClient/W3DTreeBuffer.cpp
@@ -705,14 +705,14 @@ void W3DTreeBuffer::loadTreesInVertexAndIndexBuffers(RefRenderObjListIterator *p
 		m_shadow = TheW3DProjectedShadowManager->createDecalShadow(&shadowInfo);
 	}
 
+	// TheSuperHackers @bugfix Reset bufferNdx so updateVertexBuffer skips trees absent from this rebuild.
+	for (Int t = 0; t < m_numTrees; t++) {
+		m_trees[t].bufferNdx = -1;
+	}
 	m_anythingChanged = false;
 	Int curTree=0;
 	Int bNdx;
 	const GlobalData::TerrainLighting *objectLighting = TheGlobalData->m_terrainObjectsLighting[TheGlobalData->m_timeOfDay];
-	// TheSuperHackers @info Reset bufferNdx so updateVertexBuffer skips trees absent from this rebuild.
-	for (Int t = 0; t < m_numTrees; t++) {
-		m_trees[t].bufferNdx = -1;
-	}
 	for (bNdx=0; bNdx<MAX_BUFFERS; bNdx++) {
 		m_curNumTreeVertices[bNdx] = 0;
 		m_curNumTreeIndices[bNdx] = 0;
@@ -745,17 +745,14 @@ void W3DTreeBuffer::loadTreesInVertexAndIndexBuffers(RefRenderObjListIterator *p
 
 		for ( ;curTree<m_numTrees;curTree++) {
 			Int type = m_trees[curTree].treeType;
-			if (type<0) {
-				continue; // Deleted tree. [6/9/2003]
+			if (type<0 || m_treeTypes[type].m_mesh == nullptr) {
+				continue; // Deleted tree or missing mesh. [6/9/2003]
 			}
 			if (!m_trees[curTree].visible) continue;
 			Real scale = m_trees[curTree].scale;
 			Vector3 loc = m_trees[curTree].location;
 			Real theSin = m_trees[curTree].sin;
 			Real theCos = m_trees[curTree].cos;
-			if (type<0 || m_treeTypes[type].m_mesh == nullptr) {
-				continue;
-			}
 
 			Bool doVertexLighting = true;
 
@@ -995,7 +992,6 @@ void W3DTreeBuffer::updateVertexBuffer()
 		DX8VertexBufferClass::WriteLockClass lockVtxBuffer(m_vertexTree[bNdx], D3DLOCK_DISCARD);
 	#endif
 		vb=(VertexFormatXYZNDUV1*)lockVtxBuffer.Get_Vertex_Array();
-		// TheSuperHackers @info Guard against a failed vertex buffer lock returning null.
 		if (!vb) {
 			continue;
 		}
@@ -1008,9 +1004,6 @@ void W3DTreeBuffer::updateVertexBuffer()
 				continue;
 			}
 			Int type = m_trees[curTree].treeType;
-			if (type<0) {
-				continue; // Deleted tree. [6/9/2003]
-			}
 			if (m_trees[curTree].pushAsideDelta==0.0f && m_trees[curTree].m_toppleState == TOPPLE_UPRIGHT) {
 				continue; // not toppling or pushed, no need to update. jba [7/11/2003]
 			}
@@ -1020,10 +1013,7 @@ void W3DTreeBuffer::updateVertexBuffer()
 			Vector3 loc = m_trees[curTree].location;
 			Real theSin = m_trees[curTree].sin;
 			Real theCos = m_trees[curTree].cos;
-			// TheSuperHackers @info Skip missing mesh trees to avoid using the wrong vertex count.
-			if (type<0 || m_treeTypes[type].m_mesh == nullptr) {
-				continue;
-			}
+			DEBUG_ASSERTCRASH(type>=0 && m_treeTypes[type].m_mesh!=nullptr, ("Invalid tree type or mesh."));
 
 			Int startVertex = m_trees[curTree].firstIndex;
 			curVb = vb+startVertex;