Crash of svn-1.2.x in svn_ra_open()

I've seen this as long as I've been using 1.2.x: as you might imagine, a
crash in this routine is pretty disruptive :( notably, it stops me
doing remote updates of DAV sources, like, well, subversion's. :)

Here's a backtrace and locals dump:

amaterasu 477 /usr/packages/subversion/subversion% gdb --args /usr/bin/.svn ls http://svn.collab.net/repos/svn/tags/1.2.1
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "sparc-unknown-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) run
Starting program: /usr/bin/.svn ls http://svn.collab.net/repos/svn/tags/1.2.1
[Thread debugging using libthread_db enabled]
[New Thread 16384 (LWP 28846)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 28846)]
0x7024495c in memcmp () from /lib/libc.so.6
(gdb) bt
#0 0x7024495c in memcmp () from /lib/libc.so.6
#1 0x70125968 in find_entry (ht=0x41488, key=0x70615a78, klen=15, val=0x40fa0) at tables/apr_hash.c:260
#2 0x70125b38 in apr_hash_set (ht=0x41488, key=0x70615a78, klen=-1, val=0x40fa0) at tables/apr_hash.c:338
#3 0x706102d4 in svn_ra_dav__open (session=0x72ca8, repos_URL=0x72bd8 "http://svn.collab.net/repos/svn/tags/1.2.1", callbacks=0x72c18, callback_baton=0x72c30, config=0x400, pool=0x714b8)
    at subversion/libsvn_ra_dav/session.c:710
#4 0x7009d620 in svn_ra_open (session_p=0xeff1cdd8, repos_URL=0x72bd8 "http://svn.collab.net/repos/svn/tags/1.2.1", callbacks=0x72c18, callback_baton=0x72c30, config=0x40eb0,
    pool=0x714b8) at subversion/libsvn_ra/ra_loader.c:277
#5 0x7004a03c in svn_client__open_ra_session (ra_session=0xeff1cdd8, base_url=0x72bd8 "http://svn.collab.net/repos/svn/tags/1.2.1", base_dir=0x0, base_access=0x0, commit_items=0x0,
    use_admin=0, read_only_wc=0, ctx=0x40e88, pool=0x714b8) at subversion/libsvn_client/ra.c:288
#6 0x7004af10 in svn_client__ra_session_from_path (ra_session_p=0xeff1ceb4, rev_p=0xeff1ceb0, url_p=0xeff1ceac, path_or_url=0x714f0 "http://svn.collab.net/repos/svn/tags/1.2.1",
    peg_revision_p=0xeff1cfa8, revision=0xeff1d1b0, ctx=0x72c08, pool=0x714b8) at subversion/libsvn_client/ra.c:887
#7 0x70047f98 in svn_client_ls2 (dirents=0xeff1cf50, path_or_url=0x714f0 "http://svn.collab.net/repos/svn/tags/1.2.1", peg_revision=0xeff1cfa8, revision=0xeff1d1b0, recurse=0,
    ctx=0x40e88, pool=0x714b8) at subversion/libsvn_client/ls.c:88
#8 0x000163fc in svn_cl__ls (os=0x40ab8, baton=0xeff1d0e0, pool=0x40a80) at subversion/clients/cmdline/ls-cmd.c:325
#9 0x00017d2c in main (argc=93184, argv=0x25000) at subversion/clients/cmdline/main.c:1449
(gdb) frame 1
#1 0x70125968 in find_entry (ht=0x41488, key=0x70615a78, klen=15, val=0x40fa0) at tables/apr_hash.c:260
260 if (he->hash == hash
(gdb) info locals
hep = (apr_hash_entry_t **) 0x414bc
he = (apr_hash_entry_t *) 0x41828
hash = 1584920659
(gdb) list
255 hash = ht->hash_func(key, &klen);
256
257 /* scan linked list */
258 for (hep = &ht->array[hash & ht->max], he = *hep;
259 he; hep = &he->next, he = *hep) {
260 if (he->hash == hash
261 && he->klen == klen
262 && memcmp(he->key, key, klen) == 0)
263 break;
264 }
(gdb) print (char *)key
$2 = 0x70615a78 "svn:auth:config"
(gdb) print (char *)he->key
$3 = 0x705fda78 <Address 0x705fda78 out of bounds>
(gdb)
(gdb) frame 2
#2 0x70125b38 in apr_hash_set (ht=0x41488, key=0x70615a78, klen=-1, val=0x40fa0) at tables/apr_hash.c:338
338 hep = find_entry(ht, key, klen, val);
(gdb) list
333 const void *key,
334 apr_ssize_t klen,
335 const void *val)
336 {
337 apr_hash_entry_t **hep;
338 hep = find_entry(ht, key, klen, val);
339 if (*hep) {
340 if (!val) {
341 /* delete entry */
342 apr_hash_entry_t *old = *hep;
(gdb) frame 3
#3 0x706102d4 in svn_ra_dav__open (session=0x72ca8, repos_URL=0x72bd8 "http://svn.collab.net/repos/svn/tags/1.2.1", callbacks=0x72c18, callback_baton=0x72c30, config=0x400, pool=0x714b8)
    at subversion/libsvn_ra_dav/session.c:710
710 svn_auth_set_parameter(ras->callbacks->auth_baton,
(gdb) list
705 ras->sess2 = sess2;
706 ras->callbacks = callbacks;
707 ras->callback_baton = callback_baton;
708 ras->compression = compression;
709 /* save config and server group in the auth parameter hash */
710 svn_auth_set_parameter(ras->callbacks->auth_baton,
711 SVN_AUTH_PARAM_CONFIG, cfg);
712 svn_auth_set_parameter(ras->callbacks->auth_baton,
713 SVN_AUTH_PARAM_SERVER_GROUP, server_group);
714
(gdb)

(GCC-3.4.4 has inlined the svn_auth_set_parameter() call into its caller, so
it doesn't appear in the backtrace.)

I've seen this both with apr-1.0.1/apr-util 1.0.1 and with
apr-1.1.1/apr-util-1.1.2.

I'm trying to hunt down where this hash element is added, but it'd be
useful if I knew if anyone had seen this already.

-- 
`But of course, GR is the very best relativity for the masses.'
 --- Wayne Throop
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org