I've recently encountered strange code in
subversion/libsvn_client/blame.c:file_rev_handler():
[[[
....
/* Prepare the text delta window handler. */
if (frb->last_filename)
SVN_ERR(svn_stream_open_readonly(&delta_baton->source_stream,
frb->last_filename,
frb->currpool, pool));
else
/* Means empty stream below. */
delta_baton->source_stream = NULL;
last_stream = svn_stream_disown(delta_baton->source_stream, pool);
....
/* Handle all delta - even if it is empty.
We must do the latter to "merge" blame info from other branches. */
if (content_delta_handler)
{
/* Proper delta - get window handler for applying delta.
svn_ra_get_file_revs2 will drive the delta editor. */
svn_txdelta_apply(last_stream, cur_stream, NULL, NULL,
frb->currpool,
&delta_baton->wrapped_handler,
&delta_baton->wrapped_baton);
*content_delta_handler = window_handler;
*content_delta_baton = delta_baton;
}
else
{
/* Apply an empty delta, i.e. simply copy the old contents.
We can't simply use the existing file due to the pool rotation logic.
Trigger the blame update magic. */
SVN_ERR(svn_stream_copy3(last_stream, cur_stream, NULL, NULL, pool));
SVN_ERR(update_blame(delta_baton));
}
]]]]
As far I understand svn_stream_disown() could be called for NULL
stream, later this stream (LAST_STREAM) used as parameter for
svn_txdelta_apply() or svn_stream_copy3().
The question why it doesn't crash? And how this code supposed to work?
Bert, do you have any ideas? I see you change this code multiple times recently.
--
Ivan Zhakov
Received on 2015-09-02 15:01:49 CEST