You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Carsten Koch <Ca...@icem.com> on 2006/02/16 16:53:57 UTC

"svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

A user here has a branch that starts at r15305:

% svn log -v --stop-on-copy
------------------------------------------------------------------------
r15311 | jm | 2006-02-06 10:41:37 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    M /tools/mods/jm-docu2

submit_mod committed property changes for mod jm-docu2.
------------------------------------------------------------------------
r15306 | jm | 2006-02-06 10:35:39 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    A /tools/mods/jm-docu2/docu

create docu directory for icem documentation tools
------------------------------------------------------------------------
r15305 | jm | 2006-02-06 10:30:52 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    A /tools/mods/jm-docu2 (from /tools/trunk:15304)

Begin jm-docu2 mod branch.
------------------------------------------------------------------------

The branch creates a subdirectory and manipulates
properties on the top-level directory, it does not
make any changes to files.

The command
    svn diff -r15305
in a working copy of this branch
crashes with a segmentation fault:

% svn diff -r15305
Segmentation fault


I tried this with svn 1.3 and svn 1.1.3 under Linux.

Here is the stack trace of the svn 1.3 crash:

(gdb) run diff -r15305
Starting program: /usr/local/bin/svn diff -r15305
[Thread debugging using libthread_db enabled]
[New Thread 1076981024 (LWP 22990)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1076981024 (LWP 22990)]
0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
811     diff.c: No such file or directory.
         in diff.c
(gdb) bt full
#0  0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
         pb = <value optimized out>
         eb = (struct edit_baton *) 0x80909c0
         entry = (const svn_wc_entry_t *) 0x0
         b = (struct dir_baton *) 0x0
         full_path = 0x80ae528 "docu"
         adm_access = (svn_wc_adm_access_t *) 0x8084f28
         working_mimetype = 0x1 <Address 0x1 out of bounds>
         pristine_mimetype = 0x0
         baseprops = (apr_hash_t *) 0x4
#1  0x400cc7a7 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad098, pool=0x80cb610) at cancel.c:92
         svn_err__temp = (svn_error_t *) 0x0
         eb = <value optimized out>
#2  0x400beeb4 in start_element (userdata=0x8090aa0, parent_state=237, nspace=0x8091eb0 "svn:", elt_name=0x80af0f8 "delete-entry", atts=0x80844b8) at fetch.c:2352
         encoding = <value optimized out>
         rb = <value optimized out>
         att = <value optimized out>
         name = <value optimized out>
         bc_url = <value optimized out>
         cpath = (svn_stringbuf_t *) 0x0
         crev = -1
         parent_dir = (dir_item_t *) 0x80a5508
         new_dir_baton = <value optimized out>
         pathbuf = (svn_stringbuf_t *) 0x80cb650
         subpool = (apr_pool_t *) 0x80cb610
         base_checksum = <value optimized out>
         elm = (const svn_ra_dav__xml_elm_t *) 0x400ca110
#3  0x401c5606 in start_element (userdata=0x809da98, name=0x80acc40 "S:delete-entry", atts=0x80844b8) at ne_xml.c:329
         elm = (struct element *) 0x80af098
         hand = (struct handler *) 0x808b598
         state = 0
#4  0x401e5736 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#5  0x401e60ae in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#6  0x401e71a8 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#7  0x401e7bf5 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#8  0x401df649 in XML_ParseBuffer () from /usr/lib/libexpat.so.0
No symbol table info available.
#9  0x401e0c5a in XML_Parse () from /usr/lib/libexpat.so.0
No symbol table info available.
#10 0x401c511b in ne_xml_parse (p=0x809da98,
     block=0x80b1608 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<S:update-report xmlns:S=\"svn:\" xmlns:V=\"http://subversion.tigris.org/xmlns/dav/\" xmlns:D=\"DAV:\" >\n<S:target-revision rev=\"15305\"/>\n<S:open-directory rev=\"15665\""..., len=752) at ne_xml.c:530
         ret = <value optimized out>
         flag = 0
#11 0x400c78c4 in parsed_request (sess=0x8097670, method=0x400c7ff1 "REPORT", url=0x80a5998 "/svn/!svn/vcc/default", body=0x0, body_file=0x8090d80, set_parser=0, elements=0x0, use_neon_shim=0, validate_compat_cb=0,
     startelm_compat_cb=0, endelm_compat_cb=0, startelm_cb=0x400be790 <start_element>, cdata_cb=0x400be600 <cdata_handler>, endelm_cb=0x400bde20 <end_element>, baton=0x8090aa0, extra_headers=0x0, status_code=0x0, spool_response=1,
     pool=0x8068170) at util.c:550
         subpool = (apr_pool_t *) 0x80a82f8
         req = (ne_request *) 0x80aa2e8
         decompress_main = (ne_decompress *) 0x80ac418
         decompress_err = (ne_decompress *) 0x80ae490
         success_parser = (ne_xml_parser *) 0x809da98
         error_parser = (ne_xml_parser *) 0x8092be8
         rv = 0
         code = 200
         expected_code = 200
         msg = <value optimized out>
         spool_reader_baton = {spool_file_name = 0x80a5d38 "/tmp/dav-spool.4", spool_file = 0x80a5da8, pool = 0x8068170, error = 0x0}
         err = <value optimized out>
         ras = (svn_ra_dav__session_t *) 0x8090940
#12 0x400c796e in svn_ra_dav__parsed_request (sess=0x0, method=0xbfffd784 "", url=0x1f <Address 0x1f out of bounds>, body=0x0, body_file=0x8090d80, set_parser=0, startelm_cb=0x400be790 <start_element>,
     cdata_cb=0x400be600 <cdata_handler>, endelm_cb=0x400bde20 <end_element>, baton=0x8090aa0, extra_headers=0x0, status_code=0x0, spool_response=1, pool=0x8068170) at util.c:849
No locals.
---Type <return> to continue, or q <return> to quit---
#13 0x400bd477 in reporter_finish_report (report_baton=0x8090aa0, pool=0x8068170) at fetch.c:2870
         err = <value optimized out>
         vcc = 0x80a5998 "/svn/!svn/vcc/default"
#14 0x4004069a in svn_wc_crawl_revisions2 (path=0x8080c40 "", adm_access=0x8084f28, reporter=0x400ca040, report_baton=0x8090aa0, restore_files=0, recurse=1, use_commit_times=0, notify_func=0, notify_baton=0x0, traversal_info=0x0,
     pool=0x8068170) at adm_crawler.c:627
         info = {pool = 0x8068170, valid = 7598448, protection = 1877, filetype = APR_DIR, user = 20115, group = 100, inode = 67274276, device = 15, nlink = 3, size = 4096, csize = 0, atime = 1140098360000000,
   mtime = 1140098276000000, ctime = 1140098276000000, fname = 0x80a54e8 ".", name = 0x4001c157 "svn_wc_crawl_revisions2", filehand = 0x4003b6f0}
         fserr = <value optimized out>
         err = (svn_error_t *) 0x0
         entry = (const svn_wc_entry_t *) 0x0
         base_rev = 15665
         missing = 0
         parent_entry = <value optimized out>
         notify = <value optimized out>
#15 0x4002aad5 in diff_repos_wc (options=<value optimized out>, path1=<value optimized out>, revision1=0xbfffe010, peg_revision=0xbfffdec0, path2=0x8080c40 "", revision2=0x0, reverse=0, recurse=1, ignore_ancestry=1,
     callbacks=0xbfffddd0, callback_baton=0xbfffddf0, ctx=0x80686e0, pool=0x8068170) at diff.c:2051
         svn_err__temp = (svn_error_t *) 0x0
         url1 = <value optimized out>
         anchor = 0x8084f50 ""
         anchor_url = 0x8097210 "http://svn/svn/tools/mods/jm-docu2"
         target = <value optimized out>
         adm_access = (svn_wc_adm_access_t *) 0x8084f28
         dir_access = (svn_wc_adm_access_t *) 0x8084f28
         entry = <value optimized out>
         rev = <value optimized out>
         ra_session = (svn_ra_session_t *) 0x8090900
         reporter = (const svn_ra_reporter2_t *) 0x400ca040
         report_baton = (void *) 0x8090aa0
         diff_editor = (const svn_delta_editor_t *) 0x8090a38
         diff_edit_baton = (void *) 0x8090a78
         rev2_is_base = 0
#16 0x4002aee6 in svn_client_diff_peg3 (options=0x8080b10, path=0x8080c40 "", peg_revision=0xbfffdec0, start_revision=0xbfffe010, end_revision=0xbfffe01c, recurse=1, ignore_ancestry=1, no_diff_deleted=0, ignore_content_type=0,
     header_encoding=0x0, outfile=0x0, errfile=0x0, ctx=0x80686e0, pool=0x8068170) at diff.c:2206
         svn_err__temp = (svn_error_t *) 0x0
         diff_cmd_baton = {options = 0x8080b10, pool = 0x8068170, outfile = 0x8080b48, errfile = 0x8080b90, header_encoding = 0x1 <Address 0x1 out of bounds>, orig_path_1 = 0x8090878 "http://svn/svn/tools/mods/jm-docu2",
   orig_path_2 = 0x80908a0 "http://svn/svn/tools/mods/jm-docu2", revnum1 = 15305, revnum2 = -1, config = 0x8068718, force_binary = 0, force_empty = 0}
         diff_callbacks = {file_changed = 0x4002b660 <diff_file_changed>, file_added = 0x4002bd00 <diff_file_added>, file_deleted = 0x4002bc90 <diff_file_deleted_with_diff>, dir_added = 0x40028840 <diff_dir_added>,
   dir_deleted = 0x40028860 <diff_dir_deleted>, dir_props_changed = 0x4002b370 <diff_props_changed>}
#17 0x0804d24c in svn_cl__diff (os=0x8068288, baton=0xbfffdf68, pool=0x8068170) at diff-cmd.c:215
         svn_err__temp = (svn_error_t *) 0x0
         truepath = 0x8080c40 ""
         peg_revision = {kind = svn_opt_revision_working, value = {number = 0, date = 0}}
         path = <value optimized out>
         target1 = 0x0
         target2 = <value optimized out>
         opt_state = (svn_cl__opt_state_t *) 0xbfffe010
         options = (apr_array_header_t *) 0x8080b10
         targets = <value optimized out>
         outfile = (apr_file_t *) 0x8080b48
         errfile = (apr_file_t *) 0x8080b90
         status = <value optimized out>
         old_target = 0x805629c ""
         new_target = 0x805629c ""
         subpool = (apr_pool_t *) 0x80822d0
         pegged_diff = 1
         i = 0
#18 0x080508ed in main (argc=3, argv=0xbfffe174) at main.c:1476
         first_arg_utf8 = 0x0
         first_arg = <value optimized out>
         err = <value optimized out>
         allocator = (apr_allocator_t *) 0x80680e8
         pool = (apr_pool_t *) 0x8068170
         opt_id = <value optimized out>
         os = <value optimized out>
         opt_state = {start_revision = {kind = svn_opt_revision_number, value = {number = 15305, date = 15305}}, end_revision = {kind = svn_opt_revision_working, value = {number = 0, date = 0}}, limit = 0, recursive = 0,
   nonrecursive = 0, no_unlock = 0, message = 0x0, ancestor_path = 0x0, force = 0, force_log = 0, incremental = 0, quiet = 0, non_interactive = 0, version = 0, verbose = 0, update = 0, strict = 0, filedata = 0x0, encoding = 0x0,
   help = 0, auth_username = 0x0, auth_password = 0x0, extensions = 0x0, targets = 0x0, xml = 0, no_ignore = 0, no_auth_cache = 0, no_diff_deleted = 0, notice_ancestry = 0, ignore_ancestry = 0, ignore_externals = 0, stop_on_copy = 0,
---Type <return> to continue, or q <return> to quit---
   dry_run = 0, revprop = 0, diff_cmd = 0x0, merge_cmd = 0x0, editor_cmd = 0x0, old_target = 0x0, new_target = 0x0, relocate = 0, config_dir = 0x0, autoprops = 0, no_autoprops = 0, native_eol = 0x0}
         ctx = <value optimized out>
         received_opts = (apr_array_header_t *) 0x80681a8
         i = <value optimized out>
         subcommand = (const svn_opt_subcommand_desc_t *) 0x805c0a0
         dash_m_arg = 0x0
         dash_F_arg = 0x0
         path_utf8 = 0x0
         apr_err = <value optimized out>
         command_baton = {opt_state = 0xbfffe010, ctx = 0x80686e0}
         ab = <value optimized out>
         cfg = (svn_config_t *) 0x8068c98
(gdb) quit


Line 811 in libsvn_wc/diff.c is
    switch (entry->kind)
and as you see from the trace above, entry is NIL,
which explains the crash.



"svn diff -r15305:head" works just fine:

% svn diff -r15305:head

Property changes on: .
___________________________________________________________________
Name: reviewers
    + ur
Name: issues_resolved
    +
Name: mod_author
    + jm
Name: documentation_changes
    + no
Name: mod_status
    + new
Name: mod_description
    + create docu directory for icem documentation tools
---
Begin jm-docu2 mod branch.
---


% svn info
Path: .
URL: http://svn/svn/tools/mods/jm-docu2
Repository Root: http://svn/svn
Repository UUID: 54d024c5-8fea-0310-b4bb-d34d78cd36a9
Revision: 15665
Node Kind: directory
Schedule: normal
Last Changed Author: jm
Last Changed Rev: 15311
Last Changed Date: 2006-02-06 10:41:37 +0100 (Mon, 06 Feb 2006)
Properties Last Updated: 2006-02-16 14:57:55 +0100 (Thu, 16 Feb 2006)


Is this a known bug?
Would you like me to file a bug report?

Cheers,
Carsten.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Garrett Rooney <ro...@electricjellyfish.net>.
On 2/20/06, Malcolm Rowe <ma...@farside.org.uk> wrote:
> On Fri, Feb 17, 2006 at 01:54:35PM -0800, Garrett Rooney wrote:
> > On 2/17/06, Garrett Rooney <ro...@electricjellyfish.net> wrote:
> > Ok, so here's a "fix" for the bug.
>
> Looks good to me, please commit.  With adjustment for bracket placement,
> it may even apply cleanly to the 1.3.x branch as well.

Committed (along with a test) in r18539.  Will propose for backport.

-garrett

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org


Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Malcolm Rowe <ma...@farside.org.uk>.
On Fri, Feb 17, 2006 at 01:54:35PM -0800, Garrett Rooney wrote:
> On 2/17/06, Garrett Rooney <ro...@electricjellyfish.net> wrote:
> Ok, so here's a "fix" for the bug.

Looks good to me, please commit.  With adjustment for bracket placement,
it may even apply cleanly to the 1.3.x branch as well.

> In an ideal world, nonrecursive checkouts would leave some indication
> that the directory in question exists, so we could check for this sort
> of case, but we don't live in an ideal world...
> 

Yes, it's pretty poor at the moment - we really should work out the
'right' way to handle non-recursive checkouts, from an entries p-o-v.

> I'm also kind of curious what the "right" behavior is.  Do we just
> skip over the missing directory?  That's what I've done here, but I'm
> not convinced it's correct.
> 

I think so - it's not part of the checked-out wc, so we arguably don't
want to see differences for it at all.

Regards,
Malcolm

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Garrett Rooney <ro...@electricjellyfish.net>.
On 2/17/06, Greg Hudson <gh...@mit.edu> wrote:
> On Fri, 2006-02-17 at 13:54 -0800, Garrett Rooney wrote:
> > Ok, so here's a "fix" for the bug.  I'm totally not sure this is the
> > right thing to do, but due to the incredible suck of nonrecursive
> > checkouts, I can't figure out a better way around it.
>
> It seems to me that we should be checking for this case anyway.  Even if
> the user reached into the .svn/entries file and carefully corrupted it
> to produce this case, we shouldn't be dereferencing a null pointer.

Makes sense to me.  We really should verify that we don't have that
problem elsewhere.  I suspect we do.

I just dislike the fact that we can't flag "the entry isn't there" as
an error in the case where the user HAS corrupted his entries file,
because it might just be a nonrecursive checkout.  I wonder how many
other places are vulnerable to that particular problem as well.

-garrett

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org


Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Greg Hudson <gh...@MIT.EDU>.
On Fri, 2006-02-17 at 13:54 -0800, Garrett Rooney wrote:
> Ok, so here's a "fix" for the bug.  I'm totally not sure this is the
> right thing to do, but due to the incredible suck of nonrecursive
> checkouts, I can't figure out a better way around it.

It seems to me that we should be checking for this case anyway.  Even if
the user reached into the .svn/entries file and carefully corrupted it
to produce this case, we shouldn't be dereferencing a null pointer.


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Garrett Rooney <ro...@electricjellyfish.net>.
On 2/17/06, Garrett Rooney <ro...@electricjellyfish.net> wrote:

> Ahh, it was the nonrecursive checkout that was throwing me.  Thanks
> for the recipie, I'll look into fixing this...

Ok, so here's a "fix" for the bug.  I'm totally not sure this is the
right thing to do, but due to the incredible suck of nonrecursive
checkouts, I can't figure out a better way around it.  When you check
out a directory nonrecursively, the child directories in it don't even
show up in .svn/entries, so when we call svn_wc_entry looking for one
of them, we get nothing back.  Of course, we can't tell that's why we
didn't get anything back, because there's no way to determine that
this was a nonrecursive checkout.  Sigh.

In an ideal world, nonrecursive checkouts would leave some indication
that the directory in question exists, so we could check for this sort
of case, but we don't live in an ideal world...

I'm also kind of curious what the "right" behavior is.  Do we just
skip over the missing directory?  That's what I've done here, but I'm
not convinced it's correct.

Anyway, here's a patch, I'd love it if someone else could confirm that
this is the only solution currently available.  I'll probably add an
actual test for this before committing it.

-garrett

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Garrett Rooney <ro...@electricjellyfish.net>.
On 2/17/06, Carsten Koch <Ca...@icem.com> wrote:
> Garrett Rooney wrote:
> > On 2/16/06, Carsten Koch <Ca...@icem.com> wrote:
> >
> >> Is this a known bug?
> >> Would you like me to file a bug report?
> >
> > I can't seem to reporduce this with either trunk or the current 1.3.x,
> > over either ra_local or ra_dav.  Would it be possible for you to
> > reduce the bug report to a script we could run that creates the new
> > branch, makes the necessary modifications to it, then runs the diff,
> > to be sure that we're doing exactly the same thing you're doing?
>
> Yes. here it is:
>
>     svn copy http://server/repository/product/trunk \
>              http://server/repository/product/mods/branch \
>              -m "create mod branch."
>     svn mkdir http://server/repository/product/mods/branch/subdir \
>              -m "create subdirectory."
>     svn checkout -N http://server/repository/product/mods/branch
>     cd branch
>     svn diff -rStartRev
>
> Here is a real-life log:
>
> % svn copy http://svn/test/cko/trunk http://svn/test/cko/mods/svn_crash -m "create mod branch."
>
> Committed revision 1741.
> % svn mkdir http://svn/test/cko/mods/svn_crash/subdir -m "create subdirectory."
>
> Committed revision 1742.
> % svn checkout  -N  http://svn/test/cko/mods/svn_crash
> A  svn_crash/display_mod_diff.py
> A  svn_crash/accept_mod.py
> A  svn_crash/show_include_deps.py
> A  svn_crash/merge_mod.py
> A  svn_crash/make_include_refs.py
> A  svn_crash/make_caa_build.py
> A  svn_crash/submit_mod.py
> A  svn_crash/check_out.py
> A  svn_crash/verify_base_libs.py
> A  svn_crash/reject_mod.py
> A  svn_crash/setup_caa_env.py
> A  svn_crash/get_mod.py
> A  svn_crash/display_include_deps.py
> A  svn_crash/re_merge_mod.py
> A  svn_crash/addfw.py
> A  svn_crash/commit_mod.py
> Checked out revision 1742.
> smasher:cko[18] cd svn_crash
> smasher:cko[19] svn diff -r1741
> Segmentation fault

Ahh, it was the nonrecursive checkout that was throwing me.  Thanks
for the recipie, I'll look into fixing this...

-garrett

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org


Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Carsten Koch <Ca...@icem.com>.
Garrett Rooney wrote:
> On 2/16/06, Carsten Koch <Ca...@icem.com> wrote:
> 
>> Is this a known bug?
>> Would you like me to file a bug report?
> 
> I can't seem to reporduce this with either trunk or the current 1.3.x,
> over either ra_local or ra_dav.  Would it be possible for you to
> reduce the bug report to a script we could run that creates the new
> branch, makes the necessary modifications to it, then runs the diff,
> to be sure that we're doing exactly the same thing you're doing? 

Yes. here it is:

    svn copy http://server/repository/product/trunk \
             http://server/repository/product/mods/branch \
             -m "create mod branch."
    svn mkdir http://server/repository/product/mods/branch/subdir \
             -m "create subdirectory."
    svn checkout -N http://server/repository/product/mods/branch
    cd branch
    svn diff -rStartRev

Here is a real-life log:

% svn copy http://svn/test/cko/trunk http://svn/test/cko/mods/svn_crash -m "create mod branch."

Committed revision 1741.
% svn mkdir http://svn/test/cko/mods/svn_crash/subdir -m "create subdirectory."

Committed revision 1742.
% svn checkout  -N  http://svn/test/cko/mods/svn_crash
A  svn_crash/display_mod_diff.py
A  svn_crash/accept_mod.py
A  svn_crash/show_include_deps.py
A  svn_crash/merge_mod.py
A  svn_crash/make_include_refs.py
A  svn_crash/make_caa_build.py
A  svn_crash/submit_mod.py
A  svn_crash/check_out.py
A  svn_crash/verify_base_libs.py
A  svn_crash/reject_mod.py
A  svn_crash/setup_caa_env.py
A  svn_crash/get_mod.py
A  svn_crash/display_include_deps.py
A  svn_crash/re_merge_mod.py
A  svn_crash/addfw.py
A  svn_crash/commit_mod.py
Checked out revision 1742.
smasher:cko[18] cd svn_crash
smasher:cko[19] svn diff -r1741
Segmentation fault


Carsten.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Garrett Rooney <ro...@electricjellyfish.net>.
On 2/16/06, Carsten Koch <Ca...@icem.com> wrote:

> Is this a known bug?
> Would you like me to file a bug report?

I can't seem to reporduce this with either trunk or the current 1.3.x,
over either ra_local or ra_dav.  Would it be possible for you to
reduce the bug report to a script we could run that creates the new
branch, makes the necessary modifications to it, then runs the diff,
to be sure that we're doing exactly the same thing you're doing?  That
would make it considerably easier to determine if the bug still exists
or not.

Thanks,

-garrett

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org


Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Carsten Koch <Ca...@icem.com>.
Malcolm Rowe wrote:
...
> Carsten: could you confirm:
> 
> a. The output of 'svn st'.

is empty.


> b. Whether 'docu' exists and is under version control.

It exists in the repository.
It did not exist in the working copy,
since I checked out the branch non-recursively.

I did an update on docu and another diff:

% svn update docu
A    docu
Updated to revision 15696.
% svn diff -r15305

Property changes on: .
___________________________________________________________________
Name: mod_author
    + jm
Name: documentation_changes
    + no
Name: mod_status
    + new
Name: mod_description
    + create docu directory for icem documentation tools
---
Begin jm-docu2 mod branch.
---


Name: reviewers
    + ur
Name: issues_resolved
    +

hp/jm-docu2>



So, after the update the diff no longer crashes.

Carsten.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Carsten Koch <Ca...@icem.com>.
Malcolm Rowe wrote:
...
> Carsten: could you confirm:
> 
> a. The output of 'svn st'.

is empty.


> b. Whether 'docu' exists and is under version control.

It exists in the repository.
It did not exist in the working copy,
since I checked out the branch non-recursively.

I did an update on docu and another diff:

% svn update docu
A    docu
Updated to revision 15696.
% svn diff -r15305

Property changes on: .
___________________________________________________________________
Name: mod_author
    + jm
Name: documentation_changes
    + no
Name: mod_status
    + new
Name: mod_description
    + create docu directory for icem documentation tools
---
Begin jm-docu2 mod branch.
---


Name: reviewers
    + ur
Name: issues_resolved
    +

hp/jm-docu2>



So, after the update the diff no longer crashes.

Carsten.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org

Re: "svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

Posted by Malcolm Rowe <ma...@farside.org.uk>.
Carsten Koch wrote:

> Program received signal SIGSEGV, Segmentation fault.
> [Switching to Thread 1076981024 (LWP 22990)]
> 0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, 
> parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
> 811     diff.c: No such file or directory.
>         in diff.c
> (gdb) bt full
> #0  0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, 
> parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
>         pb = <value optimized out>
>         eb = (struct edit_baton *) 0x80909c0
>         entry = (const svn_wc_entry_t *) 0x0
>         b = (struct dir_baton *) 0x0
>         full_path = 0x80ae528 "docu"
>         adm_access = (svn_wc_adm_access_t *) 0x8084f28
>         working_mimetype = 0x1 <Address 0x1 out of bounds>
>         pristine_mimetype = 0x0
>         baseprops = (apr_hash_t *) 0x4

 > Line 811 in libsvn_wc/diff.c is
 >    switch (entry->kind)
 > and as you see from the trace above, entry is NIL,
 > which explains the crash.

Quite. It's hard to say exactly what's happening.  The relvevant snippet 
of code is preceding this is:

   const char *full_path = svn_path_join (pb->edit_baton->anchor_path, path,
                                          pb->pool);
   svn_wc_adm_access_t *adm_access;
   const char *working_mimetype, *pristine_mimetype;
   apr_hash_t *baseprops;

   SVN_ERR (svn_wc_adm_probe_retrieve (&adm_access, pb->edit_baton->anchor,
                                       full_path, pool));
   SVN_ERR (svn_wc_entry (&entry, full_path, adm_access, FALSE, pool));
 >>switch (entry->kind)

And, as you point out, entry is NULL.  What kind of situation can cause 
'svn up -rN' to report a deletion of an entry that doesn't exist, I 
wonder? (anyone?)

Carsten: could you confirm:

a. The output of 'svn st'.
b. Whether 'docu' exists and is under version control.

Thanks,
Malcolm

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org