Gorm segfault, discovered by MrBIOS

[Jeff Teunissen]

To reproduce:

File->New Module->New Empty
Create Panel
Add popup button to panel
Double-click on it, change title of first item.
Without clicking on anything else, select the second item and delete it.
Click on panel bg. (note popup's menu does not order out, but this is not
the bug)
Click the first item.
Result: boom.

Note: do not run a backtrace for this using DDD -- it _will_ hang. gdb will
have to be forceably killed as well, because you cannot quit the backtrace
display.

Partial backtrace:
#0  GSToUnicode (dst=0xbfe04df0, size=0xbfe04df4, src=0x80bab1d "NSMenu",
    slen=6, enc=NSISOLatin1StringEncoding, zone=0x0, options=0)
    at Unicode.m:1052
#1  0x40346e8d in -[GSCString getCharacters:range:] (self=0x80ecd14,
    _cmd=0x80ecd14, buffer=0x0, aRange={location = 0, length = 6})
    at GSString.m:1131
#2  0x4033a0a6 in GSFormat (s=0xbfe05d80, format=0x8619060,
    ap=0xbfe05e2c
"\024\x{FFFD}\016\b8\211J@\x{FFFD}\x{FFFD}K@D^\x{FFFD}\x{FFFD}", locale=0x0)
at GSFormat.m:1840
#3  0x403f03b3 in -[NSString initWithFormat:locale:arguments:] (
    self=0x8181a08, _cmd=0x404be8a8, format=0x80edef8, locale=0x0,
argList=0x0)
    at NSString.m:827
#4  0x403f02de in -[NSString initWithFormat:arguments:] (self=0x8181a08,
    _cmd=0x404be870, format=0x80ecd14, argList=0x80ecd14
"\x{FFFD}IJ@\035\x{FFFD}\013\b\006")
    at NSString.m:804
#5  0x403efa4b in +[NSString stringWithFormat:] (self=0x404be720,
    _cmd=0x80eda78, format=0x80edef8) at NSZone.h:182
#6  0x080825f3 in -[GormInspectorsManager setCurrentInspector:] (
    self=0x84ac478, _cmd=0x80ed9a8, anObj=0x84ac478)
    at GormInspectorsManager.m:447
#7  0x08081f36 in -[GormInspectorsManager updateSelection] (self=0x84ac478,
    _cmd=0x80e1b10) at GormInspectorsManager.m:360
#8  0x0805242a in -[Gorm handleNotification:] (self=0x81fb170,
_cmd=0x80e16e8,
    notification=0x8618f98) at Gorm.m:1073
#9  0x403c0803 in -[NSNotificationCenter _postAndRelease:] (self=0x8176fa8,
    _cmd=0x404b6200, notification=0x8618f98) at NSNotificationCenter.m:1140
#10 0x403c0f16 in -[NSNotificationCenter
postNotificationName:object:userInfo:]
    (self=0x8176fa8, _cmd=0x404b6208, name=0x4001c1d4, object=0x84ab0d8,
    info=0x0) at NSNotificationCenter.m:1210
#11 0x403c0e0e in -[NSNotificationCenter postNotificationName:object:] (
    self=0x8176fa8, _cmd=0x80e4500, name=0x80ecd14, object=0x80ecd14)
    at NSNotificationCenter.m:1190
#12 0x08063117 in -[GormDocument setSelectionFromEditor:] (self=0x84c6d10,
    _cmd=0x80e85d0, anEditor=0x84ab0d8) at GormDocument.m:2891
#13 0x08071439 in -[GormGenericEditor selectObjects:] (self=0x84ab0d8,
    _cmd=0x41230970, anArray=0x84c6d10) at GormGenericEditor.m:291
#14 0x41221e98 in -[GormMenuEditor mouseDown:] (self=0x84dc048,
    _cmd=0x41230978, theEvent=0x84b17f0) at GormMenuEditor.m:370
#15 0x41221ecc in -[GormMenuEditor mouseDown:] (self=0x84dc048,
    _cmd=0x41230978, theEvent=0x84b17f0) at GormMenuEditor.m:372
#16 0x41221ecc in -[GormMenuEditor mouseDown:] (self=0x84dc048,
    _cmd=0x41230978, theEvent=0x84b17f0) at GormMenuEditor.m:372
:
:
at this point, the backtrace repeats itself endlessly.


-- 
| Jeff Teunissen  -=-  Pres., Dusk To Dawn Computing  -=-  deek @ d2dc.net
| GPG: 1024D/9840105A   7102 808A 7733 C2F3 097B  161B 9222 DAB8 9840 105A
| Core developer, The QuakeForge Project        http://www.quakeforge.net/
| Specializing in Debian GNU/Linux              http://www.d2dc.net/~deek/