From 15b95cc02304ee4fd09d12fee03a488ec12b8b67 Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <coelckers@users.noreply.github.com>
Date: Fri, 27 Jan 2017 10:50:35 +0100
Subject: [PATCH 1/3] - fixed: DECORATE was creating a new global constant
 namespace for each single included file, not just once per DECORATE lump.

---
 src/r_data/sprites.cpp                    | 2 +-
 src/scripting/decorate/thingdef_parse.cpp | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/r_data/sprites.cpp b/src/r_data/sprites.cpp
index b384211fc..7fb59ef94 100644
--- a/src/r_data/sprites.cpp
+++ b/src/r_data/sprites.cpp
@@ -63,7 +63,7 @@ static bool R_InstallSpriteLump (FTextureID lump, unsigned frame, char rot, bool
 
 	if (frame >= MAX_SPRITE_FRAMES || rotation > 16)
 	{
-		Printf (TEXTCOLOR_RED"R_InstallSpriteLump: Bad frame characters in lump %s\n", TexMan[lump]->Name.GetChars());
+		Printf (TEXTCOLOR_RED "R_InstallSpriteLump: Bad frame characters in lump %s\n", TexMan[lump]->Name.GetChars());
 		return false;
 	}
 
diff --git a/src/scripting/decorate/thingdef_parse.cpp b/src/scripting/decorate/thingdef_parse.cpp
index 9b78ef3d5..505585937 100644
--- a/src/scripting/decorate/thingdef_parse.cpp
+++ b/src/scripting/decorate/thingdef_parse.cpp
@@ -1217,9 +1217,8 @@ static void ParseDamageDefinition(FScanner &sc)
 //
 //==========================================================================
 
-void ParseDecorate (FScanner &sc)
+void ParseDecorate (FScanner &sc, PNamespace *ns)
 {
-	auto ns = Namespaces.NewNamespace(sc.LumpNum);
 	// Get actor class name.
 	for(;;)
 	{
@@ -1245,7 +1244,7 @@ void ParseDecorate (FScanner &sc)
 			}
 			FScanner newscanner;
 			newscanner.Open(sc.String);
-			ParseDecorate(newscanner);
+			ParseDecorate(newscanner, ns);
 			break;
 		}
 
@@ -1308,6 +1307,7 @@ void ParseAllDecorate()
 	while ((lump = Wads.FindLump("DECORATE", &lastlump)) != -1)
 	{
 		FScanner sc(lump);
-		ParseDecorate(sc);
+		auto ns = Namespaces.NewNamespace(sc.LumpNum);
+		ParseDecorate(sc, ns);
 	}
 }
\ No newline at end of file

From 08c252274ab3a5220cb0c9b5a79869b1c4f7d0d7 Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <coelckers@users.noreply.github.com>
Date: Fri, 27 Jan 2017 12:02:47 +0100
Subject: [PATCH 2/3] - fixed issues with uninitialized RNGs and bad
 assumptions about corpse pointers always being fully initialized when being
 destroyed.

Both of these may be true when occuring during normal gameplay, but not during an exception unwind in the serializer, which caused crashes if ACS errored out due to mismatched scripts.
---
 src/g_shared/a_action.cpp | 24 ++++++++++++++----------
 src/m_random.cpp          |  2 ++
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/g_shared/a_action.cpp b/src/g_shared/a_action.cpp
index ddfd23268..aed8457f8 100644
--- a/src/g_shared/a_action.cpp
+++ b/src/g_shared/a_action.cpp
@@ -142,21 +142,25 @@ void DCorpsePointer::OnDestroy ()
 	TThinkerIterator<DCorpsePointer> iterator (STAT_CORPSEPOINTER);
 	DCorpsePointer *first = iterator.Next ();
 
-	int prevCount = first->Count;
-
-	if (first == this)
+	// During a serialization unwind the thinker list won't be available.
+	if (first != nullptr)
 	{
-		first = iterator.Next ();
-	}
+		int prevCount = first->Count;
 
-	if (first != NULL)
-	{
-		first->Count = prevCount - 1;
-	}
+		if (first == this)
+		{
+			first = iterator.Next();
+		}
 
+		if (first != NULL)
+		{
+			first->Count = prevCount - 1;
+		}
+
+	}
 	if (Corpse != NULL)
 	{
-		Corpse->Destroy ();
+		Corpse->Destroy();
 	}
 	Super::OnDestroy();
 }
diff --git a/src/m_random.cpp b/src/m_random.cpp
index 60ce12fd6..697bb173f 100644
--- a/src/m_random.cpp
+++ b/src/m_random.cpp
@@ -156,6 +156,7 @@ FRandom::FRandom ()
 #endif
 	Next = RNGList;
 	RNGList = this;
+	Init(0);
 }
 
 //==========================================================================
@@ -199,6 +200,7 @@ FRandom::FRandom (const char *name)
 
 	Next = probe;
 	*prev = this;
+	Init(0);
 }
 
 //==========================================================================

From 1eb2c753288a8baf61535aed4c5d25f39013de7e Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <coelckers@users.noreply.github.com>
Date: Fri, 27 Jan 2017 16:14:53 +0100
Subject: [PATCH 3/3] - explode bouncing objects directly inside P_BounceActor
 if the bounce count expired. The calling code is too messed up to handle this
 cleanly.

---
 src/p_map.cpp | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/p_map.cpp b/src/p_map.cpp
index ac5ca10a7..4e5cc31fd 100644
--- a/src/p_map.cpp
+++ b/src/p_map.cpp
@@ -3532,7 +3532,14 @@ bool P_BounceActor(AActor *mo, AActor *BlockingMobj, bool ontop)
 		|| ((mo->flags6 & MF6_NOBOSSRIP) && (BlockingMobj->flags2 & MF2_BOSS))) && (BlockingMobj->flags2 & MF2_REFLECTIVE))
 		|| ((BlockingMobj->player == NULL) && (!(BlockingMobj->flags3 & MF3_ISMONSTER)))))
 	{
-		if (mo->bouncecount > 0 && --mo->bouncecount == 0) return false;
+		if (mo->bouncecount>0 && --mo->bouncecount == 0)
+		{
+			if (mo->flags & MF_MISSILE)
+				P_ExplodeMissile(mo, nullptr, nullptr);
+			else
+				mo->CallDie(nullptr, nullptr);
+			return true;
+		}
 
 		if (mo->flags7 & MF7_HITTARGET)	mo->target = BlockingMobj;
 		if (mo->flags7 & MF7_HITMASTER)	mo->master = BlockingMobj;