[Freeciv-Dev] (PR#11722) Gtk 2.0 client crash, City dialog, Change menu

["Benedict Adamson" <badamson@xxxxxxxxxxx>]

<URL: http://bugs.freeciv.org/Ticket/Display.html?id=11722 >

If I select a city in the city dialog, then click on the 'Change' entry 
on the menu bar, the client crashes. The problem is reproduceable. This 
is the Gtk 2.0 client of the development version of 2004-12-29, using 
Debian GNU/Linux 'sarge', gcc 3.3.5 (Debian 1:3.3.5-5).

The back trace for the normal variant is confusing because the compiler 
in lines some functions automatically. Here a back trace from a client 
configured with CFLAGS="-O0 -g":
#0  0x080a76a3 in city_owner (pcity=0x0) at city.c:366
#1  0x0806c2ab in get_city_dialog_production_row (buf=0xbfff6610,
     column_size=64, id=3, is_unit=false, pcity=0x0) at citydlg_common.c:332
#2  0x08112f64 in append_impr_or_unit_to_menu_item (parent_item=0x84dd260,
     append_units=false, append_wonders=false, city_operation=CO_CHANGE,
     test_func=0x8070a9e <city_can_build_impr_or_unit>,
     callback=0x811342d <select_impr_or_unit_callback>, size=1) at 
cityrep.c:273
#3  0x08115650 in popup_change_menu (menu=0x84d2658, data=0x0)
     at cityrep.c:1276
#4  0x4042b121 in g_cclosure_marshal_VOID__VOID ()
    from /usr/lib/libgobject-2.0.so.0
#5  0x40416c20 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#6  0x4042ac25 in g_signal_emit_by_name () from /usr/lib/libgobject-2.0.so.0
#7  0x40429be7 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#8  0x40429ee4 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#9  0x4023fda6 in gtk_widget_show () from /usr/lib/libgtk-x11-2.0.so.0
#10 0x40148f8b in gtk_menu_popup () from /usr/lib/libgtk-x11-2.0.so.0
#11 0x40151292 in gtk_menu_item_toggle_size_allocate ()
    from /usr/lib/libgtk-x11-2.0.so.0
#12 0x40150d04 in gtk_menu_item_toggle_size_allocate ()
    from /usr/lib/libgtk-x11-2.0.so.0
#13 0x4042b121 in g_cclosure_marshal_VOID__VOID ()
    from /usr/lib/libgobject-2.0.so.0
#14 0x40416fb7 in g_cclosure_new_swap () from /usr/lib/libgobject-2.0.so.0
#15 0x40416c20 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#16 0x4042a44e in g_signal_emit_by_name () from /usr/lib/libgobject-2.0.so.0
#17 0x40429be7 in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#18 0x40429ee4 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#19 0x40127f5f in gtk_item_select () from /usr/lib/libgtk-x11-2.0.so.0
#20 0x4014fdc5 in gtk_menu_item_select () from /usr/lib/libgtk-x11-2.0.so.0
#21 0x401537b7 in gtk_menu_shell_select_item ()
    from /usr/lib/libgtk-x11-2.0.so.0
#22 0x401536c8 in gtk_menu_shell_select_item ()
    from /usr/lib/libgtk-x11-2.0.so.0
#23 0x40152a5c in _gtk_menu_shell_activate () from 
/usr/lib/libgtk-x11-2.0.so.0
#24 0x40143934 in _gtk_marshal_BOOLEAN__BOXED ()
    from /usr/lib/libgtk-x11-2.0.so.0
#25 0x40416fb7 in g_cclosure_new_swap () from /usr/lib/libgobject-2.0.so.0
#26 0x40416c20 in g_closure_invoke () from /usr/lib/libgobject-2.0.so.0
#27 0x4042a655 in g_signal_emit_by_name () from /usr/lib/libgobject-2.0.so.0
#28 0x404299be in g_signal_emit_valist () from /usr/lib/libgobject-2.0.so.0
#29 0x40429ee4 in g_signal_emit () from /usr/lib/libgobject-2.0.so.0
#30 0x40242957 in gtk_widget_send_expose () from 
/usr/lib/libgtk-x11-2.0.so.0
#31 0x40141ed2 in gtk_propagate_event () from /usr/lib/libgtk-x11-2.0.so.0
#32 0x40140c26 in gtk_main_do_event () from /usr/lib/libgtk-x11-2.0.so.0
#33 0x4033f185 in _gdk_events_queue () from /usr/lib/libgdk-x11-2.0.so.0
#34 0x40473b92 in g_main_depth () from /usr/lib/libglib-2.0.so.0
#35 0x40474c88 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#36 0x40474fc0 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#37 0x40475603 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#38 0x401404e3 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#39 0x08125045 in ui_main (argc=1, argv=0xbffff974) at gui_main.c:1200
#40 0x0806e995 in main (argc=1, argv=0xbffff974) at civclient.c:339

I'm unfamiliar with the client code, but it seems that 
append_impr_or_unit_to_menu_item is assuming that cid_is_unit(cid) will 
always return true, becaue it passes a NULL as pcity.

I also note that some of the functions in cityrep.c lack header comments.