[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

"svn diff -rN" dereferences a NIL pointer and crashes with "Segmentation fault".

From: Carsten Koch <Carsten.Koch_at_icem.com>
Date: 2006-02-16 17:53:57 CET

A user here has a branch that starts at r15305:

% svn log -v --stop-on-copy
------------------------------------------------------------------------
r15311 | jm | 2006-02-06 10:41:37 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    M /tools/mods/jm-docu2

submit_mod committed property changes for mod jm-docu2.
------------------------------------------------------------------------
r15306 | jm | 2006-02-06 10:35:39 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    A /tools/mods/jm-docu2/docu

create docu directory for icem documentation tools
------------------------------------------------------------------------
r15305 | jm | 2006-02-06 10:30:52 +0100 (Mon, 06 Feb 2006) | 1 line
Changed paths:
    A /tools/mods/jm-docu2 (from /tools/trunk:15304)

Begin jm-docu2 mod branch.
------------------------------------------------------------------------

The branch creates a subdirectory and manipulates
properties on the top-level directory, it does not
make any changes to files.

The command
    svn diff -r15305
in a working copy of this branch
crashes with a segmentation fault:

% svn diff -r15305
Segmentation fault

I tried this with svn 1.3 and svn 1.1.3 under Linux.

Here is the stack trace of the svn 1.3 crash:

(gdb) run diff -r15305
Starting program: /usr/local/bin/svn diff -r15305
[Thread debugging using libthread_db enabled]
[New Thread 1076981024 (LWP 22990)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1076981024 (LWP 22990)]
0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
811 diff.c: No such file or directory.
         in diff.c
(gdb) bt full
#0 0x40047595 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad0a0, pool=0x80cb610) at diff.c:811
         pb = <value optimized out>
         eb = (struct edit_baton *) 0x80909c0
         entry = (const svn_wc_entry_t *) 0x0
         b = (struct dir_baton *) 0x0
         full_path = 0x80ae528 "docu"
         adm_access = (svn_wc_adm_access_t *) 0x8084f28
         working_mimetype = 0x1 <Address 0x1 out of bounds>
         pristine_mimetype = 0x0
         baseprops = (apr_hash_t *) 0x4
#1 0x400cc7a7 in delete_entry (path=0x80cb660 "docu", base_revision=-1, parent_baton=0x80ad098, pool=0x80cb610) at cancel.c:92
         svn_err__temp = (svn_error_t *) 0x0
         eb = <value optimized out>
#2 0x400beeb4 in start_element (userdata=0x8090aa0, parent_state=237, nspace=0x8091eb0 "svn:", elt_name=0x80af0f8 "delete-entry", atts=0x80844b8) at fetch.c:2352
         encoding = <value optimized out>
         rb = <value optimized out>
         att = <value optimized out>
         name = <value optimized out>
         bc_url = <value optimized out>
         cpath = (svn_stringbuf_t *) 0x0
         crev = -1
         parent_dir = (dir_item_t *) 0x80a5508
         new_dir_baton = <value optimized out>
         pathbuf = (svn_stringbuf_t *) 0x80cb650
         subpool = (apr_pool_t *) 0x80cb610
         base_checksum = <value optimized out>
         elm = (const svn_ra_dav__xml_elm_t *) 0x400ca110
#3 0x401c5606 in start_element (userdata=0x809da98, name=0x80acc40 "S:delete-entry", atts=0x80844b8) at ne_xml.c:329
         elm = (struct element *) 0x80af098
         hand = (struct handler *) 0x808b598
         state = 0
#4 0x401e5736 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#5 0x401e60ae in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#6 0x401e71a8 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#7 0x401e7bf5 in XML_ParserCreate () from /usr/lib/libexpat.so.0
No symbol table info available.
#8 0x401df649 in XML_ParseBuffer () from /usr/lib/libexpat.so.0
No symbol table info available.
#9 0x401e0c5a in XML_Parse () from /usr/lib/libexpat.so.0
No symbol table info available.
#10 0x401c511b in ne_xml_parse (p=0x809da98,
     block=0x80b1608 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<S:update-report xmlns:S=\"svn:\" xmlns:V=\"http://subversion.tigris.org/xmlns/dav/\" xmlns:D=\"DAV:\" >\n<S:target-revision rev=\"15305\"/>\n<S:open-directory rev=\"15665\""..., len=752) at ne_xml.c:530
         ret = <value optimized out>
         flag = 0
#11 0x400c78c4 in parsed_request (sess=0x8097670, method=0x400c7ff1 "REPORT", url=0x80a5998 "/svn/!svn/vcc/default", body=0x0, body_file=0x8090d80, set_parser=0, elements=0x0, use_neon_shim=0, validate_compat_cb=0,
     startelm_compat_cb=0, endelm_compat_cb=0, startelm_cb=0x400be790 <start_element>, cdata_cb=0x400be600 <cdata_handler>, endelm_cb=0x400bde20 <end_element>, baton=0x8090aa0, extra_headers=0x0, status_code=0x0, spool_response=1,
     pool=0x8068170) at util.c:550
         subpool = (apr_pool_t *) 0x80a82f8
         req = (ne_request *) 0x80aa2e8
         decompress_main = (ne_decompress *) 0x80ac418
         decompress_err = (ne_decompress *) 0x80ae490
         success_parser = (ne_xml_parser *) 0x809da98
         error_parser = (ne_xml_parser *) 0x8092be8
         rv = 0
         code = 200
         expected_code = 200
         msg = <value optimized out>
         spool_reader_baton = {spool_file_name = 0x80a5d38 "/tmp/dav-spool.4", spool_file = 0x80a5da8, pool = 0x8068170, error = 0x0}
         err = <value optimized out>
         ras = (svn_ra_dav__session_t *) 0x8090940
#12 0x400c796e in svn_ra_dav__parsed_request (sess=0x0, method=0xbfffd784 "", url=0x1f <Address 0x1f out of bounds>, body=0x0, body_file=0x8090d80, set_parser=0, startelm_cb=0x400be790 <start_element>,
     cdata_cb=0x400be600 <cdata_handler>, endelm_cb=0x400bde20 <end_element>, baton=0x8090aa0, extra_headers=0x0, status_code=0x0, spool_response=1, pool=0x8068170) at util.c:849
No locals.
---Type <return> to continue, or q <return> to quit---
#13 0x400bd477 in reporter_finish_report (report_baton=0x8090aa0, pool=0x8068170) at fetch.c:2870
         err = <value optimized out>
         vcc = 0x80a5998 "/svn/!svn/vcc/default"
#14 0x4004069a in svn_wc_crawl_revisions2 (path=0x8080c40 "", adm_access=0x8084f28, reporter=0x400ca040, report_baton=0x8090aa0, restore_files=0, recurse=1, use_commit_times=0, notify_func=0, notify_baton=0x0, traversal_info=0x0,
     pool=0x8068170) at adm_crawler.c:627
         info = {pool = 0x8068170, valid = 7598448, protection = 1877, filetype = APR_DIR, user = 20115, group = 100, inode = 67274276, device = 15, nlink = 3, size = 4096, csize = 0, atime = 1140098360000000,
   mtime = 1140098276000000, ctime = 1140098276000000, fname = 0x80a54e8 ".", name = 0x4001c157 "svn_wc_crawl_revisions2", filehand = 0x4003b6f0}
         fserr = <value optimized out>
         err = (svn_error_t *) 0x0
         entry = (const svn_wc_entry_t *) 0x0
         base_rev = 15665
         missing = 0
         parent_entry = <value optimized out>
         notify = <value optimized out>
#15 0x4002aad5 in diff_repos_wc (options=<value optimized out>, path1=<value optimized out>, revision1=0xbfffe010, peg_revision=0xbfffdec0, path2=0x8080c40 "", revision2=0x0, reverse=0, recurse=1, ignore_ancestry=1,
     callbacks=0xbfffddd0, callback_baton=0xbfffddf0, ctx=0x80686e0, pool=0x8068170) at diff.c:2051
         svn_err__temp = (svn_error_t *) 0x0
         url1 = <value optimized out>
         anchor = 0x8084f50 ""
         anchor_url = 0x8097210 "http://svn/svn/tools/mods/jm-docu2"
         target = <value optimized out>
         adm_access = (svn_wc_adm_access_t *) 0x8084f28
         dir_access = (svn_wc_adm_access_t *) 0x8084f28
         entry = <value optimized out>
         rev = <value optimized out>
         ra_session = (svn_ra_session_t *) 0x8090900
         reporter = (const svn_ra_reporter2_t *) 0x400ca040
         report_baton = (void *) 0x8090aa0
         diff_editor = (const svn_delta_editor_t *) 0x8090a38
         diff_edit_baton = (void *) 0x8090a78
         rev2_is_base = 0
#16 0x4002aee6 in svn_client_diff_peg3 (options=0x8080b10, path=0x8080c40 "", peg_revision=0xbfffdec0, start_revision=0xbfffe010, end_revision=0xbfffe01c, recurse=1, ignore_ancestry=1, no_diff_deleted=0, ignore_content_type=0,
     header_encoding=0x0, outfile=0x0, errfile=0x0, ctx=0x80686e0, pool=0x8068170) at diff.c:2206
         svn_err__temp = (svn_error_t *) 0x0
         diff_cmd_baton = {options = 0x8080b10, pool = 0x8068170, outfile = 0x8080b48, errfile = 0x8080b90, header_encoding = 0x1 <Address 0x1 out of bounds>, orig_path_1 = 0x8090878 "http://svn/svn/tools/mods/jm-docu2",
   orig_path_2 = 0x80908a0 "http://svn/svn/tools/mods/jm-docu2", revnum1 = 15305, revnum2 = -1, config = 0x8068718, force_binary = 0, force_empty = 0}
         diff_callbacks = {file_changed = 0x4002b660 <diff_file_changed>, file_added = 0x4002bd00 <diff_file_added>, file_deleted = 0x4002bc90 <diff_file_deleted_with_diff>, dir_added = 0x40028840 <diff_dir_added>,
   dir_deleted = 0x40028860 <diff_dir_deleted>, dir_props_changed = 0x4002b370 <diff_props_changed>}
#17 0x0804d24c in svn_cl__diff (os=0x8068288, baton=0xbfffdf68, pool=0x8068170) at diff-cmd.c:215
         svn_err__temp = (svn_error_t *) 0x0
         truepath = 0x8080c40 ""
         peg_revision = {kind = svn_opt_revision_working, value = {number = 0, date = 0}}
         path = <value optimized out>
         target1 = 0x0
         target2 = <value optimized out>
         opt_state = (svn_cl__opt_state_t *) 0xbfffe010
         options = (apr_array_header_t *) 0x8080b10
         targets = <value optimized out>
         outfile = (apr_file_t *) 0x8080b48
         errfile = (apr_file_t *) 0x8080b90
         status = <value optimized out>
         old_target = 0x805629c ""
         new_target = 0x805629c ""
         subpool = (apr_pool_t *) 0x80822d0
         pegged_diff = 1
         i = 0
#18 0x080508ed in main (argc=3, argv=0xbfffe174) at main.c:1476
         first_arg_utf8 = 0x0
         first_arg = <value optimized out>
         err = <value optimized out>
         allocator = (apr_allocator_t *) 0x80680e8
         pool = (apr_pool_t *) 0x8068170
         opt_id = <value optimized out>
         os = <value optimized out>
         opt_state = {start_revision = {kind = svn_opt_revision_number, value = {number = 15305, date = 15305}}, end_revision = {kind = svn_opt_revision_working, value = {number = 0, date = 0}}, limit = 0, recursive = 0,
   nonrecursive = 0, no_unlock = 0, message = 0x0, ancestor_path = 0x0, force = 0, force_log = 0, incremental = 0, quiet = 0, non_interactive = 0, version = 0, verbose = 0, update = 0, strict = 0, filedata = 0x0, encoding = 0x0,
   help = 0, auth_username = 0x0, auth_password = 0x0, extensions = 0x0, targets = 0x0, xml = 0, no_ignore = 0, no_auth_cache = 0, no_diff_deleted = 0, notice_ancestry = 0, ignore_ancestry = 0, ignore_externals = 0, stop_on_copy = 0,
---Type <return> to continue, or q <return> to quit---
   dry_run = 0, revprop = 0, diff_cmd = 0x0, merge_cmd = 0x0, editor_cmd = 0x0, old_target = 0x0, new_target = 0x0, relocate = 0, config_dir = 0x0, autoprops = 0, no_autoprops = 0, native_eol = 0x0}
         ctx = <value optimized out>
         received_opts = (apr_array_header_t *) 0x80681a8
         i = <value optimized out>
         subcommand = (const svn_opt_subcommand_desc_t *) 0x805c0a0
         dash_m_arg = 0x0
         dash_F_arg = 0x0
         path_utf8 = 0x0
         apr_err = <value optimized out>
         command_baton = {opt_state = 0xbfffe010, ctx = 0x80686e0}
         ab = <value optimized out>
         cfg = (svn_config_t *) 0x8068c98
(gdb) quit

Line 811 in libsvn_wc/diff.c is
    switch (entry->kind)
and as you see from the trace above, entry is NIL,
which explains the crash.

"svn diff -r15305:head" works just fine:

% svn diff -r15305:head

Property changes on: .
___________________________________________________________________
Name: reviewers
    + ur
Name: issues_resolved
    +
Name: mod_author
    + jm
Name: documentation_changes
    + no
Name: mod_status
    + new
Name: mod_description
    + create docu directory for icem documentation tools

---
Begin jm-docu2 mod branch.
---
% svn info
Path: .
URL: http://svn/svn/tools/mods/jm-docu2
Repository Root: http://svn/svn
Repository UUID: 54d024c5-8fea-0310-b4bb-d34d78cd36a9
Revision: 15665
Node Kind: directory
Schedule: normal
Last Changed Author: jm
Last Changed Rev: 15311
Last Changed Date: 2006-02-06 10:41:37 +0100 (Mon, 06 Feb 2006)
Properties Last Updated: 2006-02-16 14:57:55 +0100 (Thu, 16 Feb 2006)
Is this a known bug?
Would you like me to file a bug report?
Cheers,
Carsten.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Thu Feb 16 18:17:11 2006

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.