[Freeciv-Dev] (PR#10389) logging of dead explorer

["Jason Short" <jdorje@xxxxxxxxxxxxxxxxxxxxx>]

<URL: http://rt.freeciv.org/Ticket/Display.html?id=10389 >

Running the attached savegame under valgrind with the CVS code from this 
moment (Wed Sep 29 21:08:25 UTC 2004) I get (between 3200 and 3000 BC)

==12560== Invalid read of size 4
==12560==    at 0x8123C31: UNIT_LOG (ailog.c:132)
==12560==    by 0x812CE71: ai_military_attack (aiunit.c:1838)
==12560==    by 0x812D7F9: ai_manage_military (aiunit.c:2043)
==12560==    by 0x812DDE0: ai_manage_unit (aiunit.c:2182)
==12560==    by 0x812DF24: ai_manage_units (aiunit.c:2203)
==12560==    by 0x8122195: ai_do_first_activities (aihand.c:368)
==12560==    by 0x804F6DF: ai_start_turn (srv_main.c:468)
==12560==    by 0x804F95D: begin_phase (srv_main.c:540)
==12560==    by 0x805171B: main_loop (srv_main.c:1507)
==12560==    by 0x805204D: srv_loop (srv_main.c:1875)
==12560==    by 0x8051993: srv_main (srv_main.c:1626)
==12560==    by 0x804A479: main (civserver.c:170)
==12560==  Address 0x1BEAD9AC is 4 bytes inside a block of size 172 free'd
==12560==    at 0x1B905460: free (vg_replace_malloc.c:153)
==12560==    by 0x8114B4F: destroy_unit_virtual (unit.c:1731)
==12560==    by 0x80C26E3: game_remove_unit (game.c:164)
==12560==    by 0x8060845: server_remove_unit (unittools.c:1540)
==12560==    by 0x8060A59: wipe_unit_spec_safe (unittools.c:1589)
==12560==    by 0x8060F95: wipe_unit (unittools.c:1669)
==12560==    by 0x8065E38: unleash_barbarians (barbarian.c:203)
==12560==    by 0x8062BBD: hut_get_barbarians (unittools.c:2298)
==12560==    by 0x8062EA6: unit_enter_hut (unittools.c:2379)
==12560==    by 0x8063F23: move_unit (unittools.c:2777)
==12560==    by 0x80AA9DB: handle_unit_move_request (unithand.c:1133)
==12560==    by 0x8127A2C: ai_unit_move (aitools.c:543)
==12560==    by 0x807807F: do_unit_goto (gotohand.c:1362)

...although this is not the first valgrind warning; you'll have to skip 
past the PF wranings.

In aiunit.c:1835 there is code:

     /* Nothing else to do, so try exploring. */
     if (ai_manage_explorer(punit)) {
       UNIT_LOG(LOG_DEBUG, punit, "nothing else to do, so exploring");
     } else {
       UNIT_LOG(LOG_DEBUG, punit, "nothing to do - no more exploring 
either");
     }

but the unit is killed inside ai_manage_explorer so the second UNIT_LOG 
results in some invalid memory accesses.

It seems like ai_manage_explorer should return some information telling 
if the unit died.  Currently it's boolean return value does not say so. 
  Or maybe this unit_log should just be removed.  Reading this data is 
harmless but the unit_log is also useless because the data could have 
been changed.

jason