crash when merging in 1.8.1

Hi,

a crash happens when merging in 1.8.1 with the following stack trace:

> libsvn_tsvn.dll!filter_log_entry_with_rangelist(void * baton=0x0000005513aabf38, svn_log_entry_t * log_entry=0x0000005513a919b8, apr_pool_t * pool=0x8080808080808080) Line 1400 C
> libsvn_tsvn.dll!log_closed(svn_ra_serf__xml_estate_t * xes=0x0000005513aabf38, void * baton=0x0000005513d2e4e9, int leaving_state=0x1382f8c0, const svn_string_t * cdata=0x0000005513aabd00, apr_hash_t * attrs=0x0000005513a95bf0, apr_pool_t * scratch_pool=0x0000005513a919b8) Line 306 C
> libsvn_tsvn.dll!svn_ra_serf__xml_cb_end(svn_ra_serf__xml_context_t * xmlctx=0x0000005513a082ce, const char * raw_name=0x0000005513aabd98) Line 779 C
> libsvn_tsvn.dll!expat_end(void * userData=0x0000005513982c70, const char * raw_name=0x0000005513a07f07) Line 2471 C
> libaprutil_tsvn.dll!doContent(XML_ParserStruct * parser=0x00000000630d3180, int startTagLevel=0x00000000, const encoding * enc=0x00000000630d3180, const char * s=0x0000005513a082cd, const char * end=0x0000005513a083cf, const char * * nextPtr=0x0000005513982ca0) Line 2236 C
> libaprutil_tsvn.dll!contentProcessor(XML_ParserStruct * parser=0x0000005513982c70, const char * start=0x0000005513a07f07, const char * end=0x0000000000000001, const char * * endPtr=0x0000005513982c70) Line 1817 C
> libaprutil_tsvn.dll!doProlog(XML_ParserStruct * parser=0x0000005513982ea0, const encoding * enc=0x0000005513982e98, const char * s=0x0000005513982ca0, const char * end=0x0000005513a083cf, int tok=0x0000000c, const char * next=0x0000005513a07f07, const char * * nextPtr=0x0000005513982ca0) Line 3541 C
> libaprutil_tsvn.dll!prologProcessor(XML_ParserStruct * parser=0x0000005513a07f06, const char * s=0x0000005513982c70, const char * end=0x0000005513a07ee0, const char * * nextPtr=0x0000005513a083cf) Line 3302 C
> libaprutil_tsvn.dll!prologInitProcessor(XML_ParserStruct * parser=0x0000005513982c70, const char * s=0x0000005513abd02c, const char * end=0x0000000000000000, const char * * nextPtr=0x0000000000001f40) Line 3133 C
> libaprutil_tsvn.dll!XML_ParseBuffer(XML_ParserStruct * parser=0x0000005513982c70, int len=0x00000000, int isFinal=0x00000000) Line 1482 C
> libaprutil_tsvn.dll!XML_Parse(XML_ParserStruct * parser=0x0000000000000000, const char * s=0x000000c8000003e9, int len=0x13aabd98, int isFinal=0x13a7f938) Line 1472 C
> libsvn_tsvn.dll!expat_response_handler(serf_request_t * request=0x0000005513ab90f8, serf_bucket_t * response=0x0000005513a8f9b8, void * baton=0x00000000000004ef, apr_pool_t * scratch_pool=0x0000005513a8f9e8) Line 2559 C
> libsvn_tsvn.dll!handle_response(serf_request_t * request=0x0000005513a7f938, serf_bucket_t * response=0x0000000000000000, svn_ra_serf__handler_t * handler=0x0000005513aabdc0, int * serf_status=0x0000005513a8f9e8, apr_pool_t * scratch_pool=0x0000005513a8d998) Line 2055 C
> libsvn_tsvn.dll!handle_response_cb(serf_request_t * request=0x0000005513a7f938, serf_bucket_t * response=0x000000000000034e, void * baton=0x0000005500000000, apr_pool_t * scratch_pool=0x0000000000000000) Line 2091 C
> libsvn_tsvn.dll!handle_response(serf_request_t * request=0x0000000000000000, apr_pool_t * pool=0x0000000000000000) Line 914 C
> libsvn_tsvn.dll!read_from_connection(serf_connection_t * conn=0x0000005513a8d998) Line 1096 C
> libsvn_tsvn.dll!serf__process_connection(serf_connection_t * conn=0x0000005513a70fc8, short events=0x0000) Line 1209 C
> libsvn_tsvn.dll!serf_event_trigger(serf_context_t * s=0x0000005513a70fc8, void * serf_baton=0x0000000023c34600, const apr_pollfd_t * desc=0x0000005513aafba0) Line 227 C
> libsvn_tsvn.dll!serf_context_run(serf_context_t * ctx=0x0000005513aa3b88, int duration=0x13aafb20, apr_pool_t * pool=0x0000005513aafb20) Line 295 C
> libsvn_tsvn.dll!svn_ra_serf__context_run_wait(int * done=0x0000005513aa7a68, svn_ra_serf__session_t * sess=0x0000005513aabd00, apr_pool_t * scratch_pool=0x0000005513aabca0) Line 738 C
> libsvn_tsvn.dll!svn_ra_serf__get_log(svn_ra_session_t * ra_session=0x0000005513a919b8, const apr_array_header_t * paths=0x0000005513aa3b88, long start=0x0000034e, long end=0x00000000, int limit=0x00000000, int discover_changed_paths=0x00000001, int strict_node_history=0x00000000, int include_merged_revisions=0x00000000, const apr_array_header_t * revprops=0x0000005513a2c010, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * receiver=0x000007f9d8524660, void * receiver_baton=0x0000005513d2eda0, apr_pool_t * pool=0x0000005513aabca0) Line 595 C
> libsvn_tsvn.dll!svn_ra_get_log2(svn_ra_session_t * session=0x000007f9d8524660, const apr_array_header_t * paths=0x0000005513d2eba1, long start=0x139d3218, long end=0x00000000, int limit=0x00000000, int discover_changed_paths=0x00000001, int strict_node_history=0x00000000, int include_merged_revisions=0x00000000, const apr_array_header_t * revprops=0x0000005513a2c010, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * receiver=0x000007f9d8524660, void * receiver_baton=0x0000005513d2eda0, apr_pool_t * pool=0x0000005513aaba88) Line 910 C
> libsvn_tsvn.dll!run_ra_get_log(apr_array_header_t * revision_ranges=0x0000005511f39298, apr_array_header_t * paths=0x0000005513a47720, apr_array_header_t * log_segments=0x00000055139d3408, svn_client__pathrev_t * actual_loc=0x00000055139d3298, svn_ra_session_t * ra_session=0x0000005500000001, const apr_array_header_t * targets=0x0000005513a45e88, int limit=0x00000000, int discover_changed_paths=0x00000001, int strict_node_history=0x00000000, int include_merged_revisions=0x00000000, const apr_array_header_t * revprops=0x0000005513a2c010, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * real_receiver=0x000007f9d8524660, void * real_receiver_baton=0x0000005513d2eda0, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * scratch_pool=0x0000005511f39298) Line 782 C
> libsvn_tsvn.dll!svn_client_log5(const apr_array_header_t * targets=0x0000005513a45e88, const svn_opt_revision_t * peg_revision=0x0000005511e928a0, const apr_array_header_t * opt_rev_ranges=0x00000055139d3408, int limit=0x00000000, int discover_changed_paths=0x00000001, int strict_node_history=0x00000000, int include_merged_revisions=0x00000000, const apr_array_header_t * revprops=0x0000005513a2c010, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * real_receiver=0x000007f9d8524660, void * real_receiver_baton=0x0000005513d2eda0, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * pool=0x0000005511f39298) Line 894 C
> libsvn_tsvn.dll!logs_for_mergeinfo_rangelist(const char * source_url=0x0000000000000000, const apr_array_header_t * merge_source_fspaths=0x00000055139d2fc8, int filtering_merged=0x13a45df0, const apr_array_header_t * rangelist=0x0000005513a22a28, int oldest_revs_first=0x00000000, apr_hash_t * target_mergeinfo_catalog=0x0000005513a45eb0, const char * target_fspath=0x0000005513a45e68, int discover_changed_paths=0x00000001, const apr_array_header_t * revprops=0x0000005513a2c010, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * log_receiver=0x000007f9d8520f20, void * log_receiver_baton=0x0000005513d2f108, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * scratch_pool=0x0000005511f39298) Line 1562 C
> libsvn_tsvn.dll!svn_client__mergeinfo_log(int finding_merged=0x11f398a8, const char * target_path_or_url=0x0000005513d2f0a1, const svn_opt_revision_t * target_peg_revision=0x0000005511f39298, apr_hash_t * * target_mergeinfo_catalog=0x0000005511f39298, const char * source_path_or_url=0x0000005511f398a8, const svn_opt_revision_t * source_peg_revision=0x0000005513d2f098, const svn_opt_revision_t * source_start_revision=0x0000005513d2f078, const svn_opt_revision_t * source_end_revision=0x0000005513d2f088, svn_error_t * (void *, svn_log_entry_t *, apr_pool_t *) * log_receiver=0x000007f9d8520f20, void * log_receiver_baton=0x0000005513d2f108, int discover_changed_paths=0x00000001, svn_depth_t depth=svn_depth_infinity, const apr_array_header_t * revprops=0x0000005513a2c010, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * result_pool=0x0000005511f39298, apr_pool_t * scratch_pool=0x0000005511f39298) Line 2131 C
> libsvn_tsvn.dll!find_base_on_target(svn_client__pathrev_t * * base_p=0x0000005511f39298, source_and_target_t * s_t=0x00000055ffffffff, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * result_pool=0x0000005511f39670, apr_pool_t * scratch_pool=0x0000005511f39298) Line 12285 C
> libsvn_tsvn.dll!find_automatic_merge(svn_client__pathrev_t * * base_p=0x0000005511f394d8, int * is_reintegrate_like=0x0000005511f396c8, source_and_target_t * s_t=0x0000005511f3b010, svn_client_ctx_t * ctx=0x0000005513d2f598, apr_pool_t * result_pool=0x0000005511f39298, apr_pool_t * scratch_pool=0x0000005511f39298) Line 12337 C
> libsvn_tsvn.dll!client_find_automatic_merge(automatic_merge_t * * merge_p=0x0000005513d2f298, const char * source_path_or_url=0x0000005511f394d8, const svn_opt_revision_t * source_revision=0x0000005511f394d8, const char * target_abspath=0x0000005511f394d8, int allow_mixed_rev=0x00000001, int allow_local_mods=0x11f394d8, int allow_switched_subtrees=0x11f394d8, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * result_pool=0x0000005511f39298, apr_pool_t * scratch_pool=0x0000005511f39298) Line 12463 C
> libsvn_tsvn.dll!svn_client_merge_peg5(const char * source_path_or_url=0x0000005511f08208, const apr_array_header_t * ranges_to_merge=0x0000005500000002, const svn_opt_revision_t * source_peg_revision=0x0000005513d2f598, const char * target_wcpath=0x0000005511f39298, svn_depth_t depth=svn_depth_unknown, int ignore_mergeinfo=0x00000000, int diff_ignore_ancestry=0x00000000, int force_delete=0x00000000, int record_only=0x00000000, int dry_run=0x00000000, int allow_mixed_rev=0x00000001, const apr_array_header_t * merge_options=0x0000005511f39310, svn_client_ctx_t * ctx=0x0000005511e928a0, apr_pool_t * pool=0x0000005511f39298) Line 11825 C

multiple crash dumps available here:
https://www.crash-server.com/Problem.aspx?ClientID=tsvn&ProblemID=31747

Crash happens in libsvn_client/mergeinfo.c, line 1400:

if (ancestor_is_self /* Explicit mergeinfo on TARGET_PATH_AFFECTED */
     && (change->action != 'M'))
   {
     svn_rangelist_t *rangelist =
         svn_hash_gets(nearest_ancestor_mergeinfo, path);
     svn_merge_range_t *youngest_range = APR_ARRAY_IDX(
       rangelist, rangelist->nelts - 1, svn_merge_range_t *);

     if (youngest_range
         && (youngest_range->end > log_entry->revision))
       continue;
   }

 From what I can see, svn_hash_gets() returns NULL, and in the next line
rangelist->nelts then segfaults because it tries to access that null
pointer.

Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest interface to (Sub)version control
    /_/   \_\     http://tortoisesvn.net