在对象中创建另一个对象时，对象的成员变量将被重写

我有一个类的内存问题。当我在类的成员函数中创建对象时，就会出现这个问题。它是关于下面的类。我删除了成员函数，因为它们不是必需的:

class User
{
private:
    bool locked;
    bool active;
    std::vector<City> * userCitys;
    UserData userData;
    Credentials credentials;

当我调用这个函数时，问题发生了:

int User::addCity(CityData cityData) 
{
    lockUserObject(); //Everything is fine here
    City cityToAdd; //When this object is created, the memory of userCitys will get overridden
    cityToAdd.activate();
    userCitys->push_back(cityToAdd);
    int cityID = userCitys->size() - 1;
    userCitys->at(cityID).editCityData(cityData);
    unlockUserObject();
    return cityID;
}

首先，我在堆栈上创建usercity。出于测试目的，我把它放在堆上。usercity的地址被一些数据覆盖。我找不到问题所在。the City只是一个基本类:

部分标题:

class City
{
private:
    bool active;
    Supplies supplies;
    std::vector<Building> buildings;
    std::vector<Company> companies;
    std::vector<Share> shares;
    std::vector<Troop> troops;
    CityData cityData;

City::City()
{
    active = false; 
}

usercity怎么可能被重写?这一切都发生在一个线程上，所以这不会是一个问题。我试了很多方法，但就是行不通。找到问题的最佳方法是什么?

锁功能:

void User::lockUserObject()
{
    for( int i = 0; locked ; i++)
    {
        crossSleep(Settings::userLockSleepInterval);
        if( i >= Settings::userLockMaxTimes )
            Error::addError("User lock is over userLockMaxTimes",2);
    }
    locked = true;
}

City * addCity(User * user)
{
    Location location;
    location.x = 0;
    location.y = 1;
    CityData citydata;
    citydata.location = location;
    citydata.villagers = 0;
    citydata.cityName = "test city";
    int cityID = user->addCity(citydata); //addCity is called here
    City * city = user->cityAction(cityID);;
    if( city == NULL)
        Error::addError("Could not create a city",2);
    return city;
}

添加用户(测试代码):

User * addUser()
{
    UserData test;
    test.name = "testtest";
    Credentials testc("testtest",3);
    //Create object user
    int userID = UserControle::addUser(test,testc);
    User * user = UserControle::UserAction(userID);
    if( user == NULL)
        Error::addError("Could not create a user",2);
    return user;
}

我的测试函数:

void testCode()
{
    User * user = addUser();
    City * city = addCity(user);
}

这个函数在main中被调用:

int main()
{
    testCode();
    return 0;
}

下面是usercontrol中的UserAction和addUser:

int UserControle::addUser(UserData userdata, Credentials credentials)
{
    int insertID = -1;
    for( int i = 0; i < (int)UserControle::users.size(); i++)
    {
        if( !UserControle::users.at(i).isActive() )
        {
            insertID = i;
            break;
        }   
    }
    User userToInsert(userdata,credentials);
    if( insertID != -1 )
    {
        UserControle::users.insert( UserControle::users.begin() + insertID,userToInsert);
        return insertID;
    }
    else
    {
        UserControle::users.push_back(userToInsert);
        return UserControle::users.size() - 1;
    }
}
User* UserControle::UserAction(int userID) //check all indexes if greater then 0!
{
    if( (int)UserControle::users.size() <= userID )
    {
        Error::addError("UserAction is out of range",3);
        return NULL;
    }
    if( !UserControle::users.at(userID).isActive())
    {
        Error::addError("UserAction, the user is not active.",3);
        return NULL;
    }
    return &UserControle::users[userID];
}