I'm attaching a fix for this bug. :) I hope you implement it in the next release! This bug is really annoying, and the fix is simple.
I'm running the PRBoom-Plus 2.5.1.5 from Ubuntu 16's 64-bit repositories. Some maps segfault when using Open GL. Easy way to reproduce is to run Hell to Pay (HELL2PAY.WAD) and just let the opening intro animation run its course.
Crash only happens when -O2 compiler optimizations enabled. I think these are the culprits: -falign-loops -falign-labels -fexpensive-optimizations -fipa-sra -ftree-switch-conversion -ftree-pre -ftree-builtin-call-dce -ftree-vrp -fipa-ra.
Root cause is in R_Subsector(). Pointer floorplane is assigned to the address of dummyfloorplane, which is in the local call stack. Because dummyfloorplane was declared inside a nested if, it runs out of scope outside that if statement. Compiler optimizations appear to then reuse that stackframe space to allocate the next stackframe when passing dummyfloorplane into gld_AddPlane(). This results in floorplane being a dangling pointerd. Ditto ceilingplane and dummyceilingplane.
Solution is to move the declarations of dummyfloorplane and dummyceilingplane to the top of the function so that they do not go out of scope while floorplane and ceilingplane are still in scope pointing to them.
floorplane and ceilingplane are globals, so they'd have problems if these pointers were used after R_Subsector() unwinds, but I haven't had a problem with this so am assuming they aren't used in that manner.
