client SEGV with --enable-runtime-module-search

When dynamic module loading is enabled I get a SEGV

svnadmin create repo
svnadmin create repo2
svnsync initialize file://`pwd`/repo2 file://`pwd`/repo

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff76db4c5 in svn_mutex__lock (mutex=0xd1)
    at ../src-1.9/subversion/libsvn_subr/mutex.c:84
84 apr_status_t status = apr_thread_mutex_lock(mutex->mutex);
(gdb) bt
#0 0x00007ffff76db4c5 in svn_mutex__lock (mutex=0xd1)
    at ../src-1.9/subversion/libsvn_subr/mutex.c:84
#1 0x00007ffff4cd60ab in with_lock (baton=0x62a5b0, pool=0x621930)
    at ../src-1.9/subversion/libsvn_fs_fs/fs_fs.c:239
#2 0x00007ffff4cd63c9 in svn_fs_fs__with_write_lock (fs=0x61fc40,
    body=0x7ffff4cda15d <change_rev_prop_body>, baton=0x7fffffffdeb0,
    pool=0x621930) at ../src-1.9/subversion/libsvn_fs_fs/fs_fs.c:365
#3 0x00007ffff4cda367 in svn_fs_fs__change_rev_prop (fs=0x61fc40, rev=0,
    name=0x40a303 "svn:sync-lock", old_value_p=0x7fffffffdf70, value=0x628b00,
    pool=0x621930) at ../src-1.9/subversion/libsvn_fs_fs/fs_fs.c:2144
#4 0x00007ffff51370f0 in svn_fs_change_rev_prop2 (fs=0x61fc40, rev=0,
    name=0x40a303 "svn:sync-lock", old_value_p=0x7fffffffdf70, value=0x628b00,
    pool=0x621930) at ../src-1.9/subversion/libsvn_fs/fs-loader.c:1577

The problem is that the shared struct created in fs_serialized_init
doesn't live long enough:

==25549== Invalid read of size 8
==25549== at 0x8102166: init_lock_baton (fs_fs.c:265)
==25549== by 0x81022D4: create_lock_baton (fs_fs.c:317)
==25549== by 0x81023B6: svn_fs_fs__with_write_lock (fs_fs.c:365)
==25549== by 0x8106366: svn_fs_fs__change_rev_prop (fs_fs.c:2144)
==25549== by 0x7CE00EF: svn_fs_change_rev_prop2 (fs-loader.c:1577)
==25549== by 0x7AA8CC2: svn_repos_fs_change_rev_prop4 (fs-wrap.c:404)
==25549== by 0x7887C7C: svn_ra_local__change_rev_prop (ra_plugin.c:750)
==25549== by 0x4E3DC5D: svn_ra_change_rev_prop2 (ra_loader.c:576)
==25549== by 0x4E409EE: svn_ra__get_operational_lock (util.c:250)
==25549== by 0x402A60: get_lock (svnsync.c:399)
==25549== by 0x402AEA: with_locked (svnsync.c:457)
==25549== by 0x403C7C: initialize_cmd (svnsync.c:909)
==25549== Address 0x74be778 is 24 bytes inside a block of size 56 free'd
==25549== at 0x4C29E90: free (vg_replace_malloc.c:473)
==25549== by 0x55C7096: pool_clear_debug (apr_pools.c:1576)
==25549== by 0x55C71EA: pool_destroy_debug (apr_pools.c:1638)
==25549== by 0x55C6FAA: pool_clear_debug (apr_pools.c:1550)
==25549== by 0x55C71EA: pool_destroy_debug (apr_pools.c:1638)
==25549== by 0x55C72D3: apr_pool_destroy_debug (apr_pools.c:1680)
==25549== by 0x4E3D696: svn_ra_open4 (ra_loader.c:431)
==25549== by 0x403F57: open_target_session (svnsync.c:996)
==25549== by 0x403BE6: initialize_cmd (svnsync.c:905)
==25549== by 0x407384: sub_main (svnsync.c:2380)
==25549== by 0x407463: main (svnsync.c:2414)

This is with 1.9.x.

-- 
Philip Martin | Subversion Committer
WANdisco // *Non-Stop Data*