Update of bug #16451 (project freeciv):

                Severity:              3 - Normal => 4 - Important          
                  Status:                    None => Ready For Test         
             Assigned to:                    None => jtn                    
         Planned Release:                         => 2.3.0,2.4.0            


Follow-up Comment #13:

Looking at that valgrind log finds *a* bug: in ai_hunter_try_launch():

     ai_unit_goto(missile, sucker->tile);
     sucker = game_find_unit_by_number(target_sanity); /* Sanity */
     if (sucker && is_tiles_adjacent(sucker->tile, missile->tile)) {
       ai_unit_attack(missile, sucker->tile);

The log suggests that what likely happened is that ai_unit_goto() killed
'missile' (in this case I think it was attacking an AEGIS Cruiser), but the
code two lines down references 'missile->tile' (freed memory), which can
return crap which itself gets dereferenced, causing the crash.

ai_unit_goto() returns FALSE if 'missile' died, so we should check that
before dereferencing it. Also, the possibility of 'missile' dying suggests
that this function should be using unit_list_iterate_safe rather than
unit_list_iterate, although I don't think that's implicated in the current

While 'missile' will die if it attacks whether or not it sees off 'sucker', I
think this only bites if it fails to do so, as otherwise 'sucker' will become
NULL. (I'm not sure in what circumstances the offending code will fire -- we
aimed at 'sucker' with ai_unit_goto(), but somehow failed to reach them, yet
ai_unit_attack() still has a chance of getting them?) but I've left it in

I ran my proposed fix for S2_2 through valgrind and it didn't show any errors
in ai_hunter_try_launch(), so I'm fairly confident this is the fix for the
originally reported problem.

The same problem still seems to exist on S2_3 and trunk.

(file #12630, file #12631, file #12632)

Additional Item Attachment:

File name: S2_2-ai-missile-fail-crash.diff Size:1 KB
File name: S2_3-ai-missile-fail-crash.diff Size:1 KB
File name: trunk-ai-missile-fail-crash.diff Size:1 KB


Reply to this item at:


  Message sent via/by Gna!

Freeciv-dev mailing list

Reply via email to