segfault when merging

Hi,

There were quite a few crash reports sent for TSVN which indicate a
problem when merging. Until now I never really had a good crash dump and
also no user to contact.

But now that's changed:
User report is here:
http://tortoisesvn.tigris.org/ds/viewMessage.do?dsForumId=4061&dsMessageId=3023140

Crash dump available here:
https://www.crash-server.com/Problem.aspx?ClientID=tsvn&Login=Guest&ProblemID=6224
(you should know the login data already, if not please contact my
privately).

Here's what I found so far:
libsvn_client\merge.c, calculate_left_hand_side()

/* Convert the absolute path with mergeinfo on it to a path relative
  to the session root. */
SVN_ERR(svn_client__path_relative_to_root(&path_rel_to_root,
                                         ctx->wc_ctx, absolute_path,
                                         target_repos_root, FALSE,
                                         NULL, scratch_pool,
                                         iterpool));
path_rel_to_session = svn_relpath_skip_ancestor(target_repos_rel_path,
                                               path_rel_to_root);
SVN_ERR(svn_client__repos_location_segments(&segments,
                                           target_ra_session,
                                           path_rel_to_session,
                                           target_rev, target_rev,
                                           SVN_INVALID_REVNUM,
                                           ctx, scratch_pool));

here, the 'path_rel_to_session' is set to NULL by the
svn_relpath_skip_ancestor() call, which then leads to a NULL-pointer
access later on in svn_client__repos_location_segments and further down
in svn_ra_get_location_segments():
   SVN_ERR_ASSERT(*path != '/');

where 'path' is the NULL pointer of path_rel_to_session.

svn_relpath_skip_ancestor() returns NULL if the paths are not related or
if the second argument string does not end with a '/'.
Gathering from the crash dump I can see that the second argument points
to a file so it does not end with a '/' char.

The two strings passed to svn_relpath_skip_ancestor() are according to
the crash dump:
somename/branches/dev62
and
shared/trunk/somefile.bas

(somename and somefile used to protect the innocent).

I hope this helps to figure out why the crash happens - I'm not familiar
with the merge code so someone else needs to look at this.

Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest Interface to (Sub)Version Control
    /_/   \_\     http://tortoisesvn.net