assertion failed / segfault in svn_ra_do_diff3

I recently caught a segfault / assertion fail in svn client.

svn, version 1.8.5 (r1542147)
   compiled Dec 2 2013, 21:40:18 on x86_64-unknown-linux-gnu (built from sources on Ubuntu 12.04 LTS)

It was a reproducible segfault at command something like that
svn up -r XXXXXXX ..

Here is a backtrace, all coredumps are saved for future analysis.

0x00007f58656ee425 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007f58656f1b8b in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2 0x00007f5865efcabe in svn_error_abort_on_malfunction (can_return=<optimized out>, file=<optimized out>, line=<optimized out>, expr=<optimized out>) at subversion/libsvn_subr/error.c:722
#3 0x00007f58665f6cdd in svn_ra_do_diff3 (session=0x1c83770, reporter=0x7fff6cc76f48, report_baton=0x7fff6cc76f98, revision=1403046, diff_target=<optimized out>, depth=<optimized out>, ignore_ancestry=1, text_deltas=1, versus
_url=0x1bf41e8 "svn+ssh://arcadia.yandex.ru/arc/trunk/arcadia/yweb/robot/queuer", diff_editor=0x1bf48c8, diff_baton=0x1bf4948, pool=0x1bf3228) at subversion/libsvn_ra/ra_loader.c:870
#4 0x00007f5866ad0d73 in diff_repos_wc (path_or_url1=path_or_url1_at_entry=0x1c41b10 "..", revision1=revision1_at_entry=0x7fff6cc77568, peg_revision=peg_revision_at_entry=0x7fff6cc773b0, path2=path2_at_entry=0x1c41b10 "..", reverse=rever
se_at_entry=0, depth=depth_at_entry=svn_depth_unknown, ignore_ancestry=ignore_ancestry_at_entry=1, show_copies_as_adds=show_copies_as_adds_at_entry=0, use_git_diff_format=use_git_diff_format_at_entry=0, changelists=changelists_at_entry=0x1bed79
0, callbacks=callbacks_at_entry=0x7f5866d0acc0 <diff_callbacks>, callback_baton=callback_baton_at_entry=0x7fff6cc77190, cmd_baton=cmd_baton_at_entry=0x7fff6cc77190, ctx=ctx_at_entry=0x1bee980, scratch_pool=scratch_pool_at_entry=0x1bf3228, re
vision2=0x7fff6cc77578) at subversion/libsvn_client/diff.c:2027
#5 0x00007f5866ad22d5 in do_diff (callback_baton=callback_baton_at_entry=0x7fff6cc77190, ctx=ctx_at_entry=0x1bee980, path_or_url1=path_or_url1_at_entry=0x1c41b10 "..", path_or_url2=path_or_url2_at_entry=0x1c41b10 "..", revision1=revision
1_at_entry=0x7fff6cc77568, revision2=revision2_at_entry=0x7fff6cc77578, peg_revision=peg_revision_at_entry=0x7fff6cc773b0, depth=depth_at_entry=svn_depth_unknown, ignore_ancestry=ignore_ancestry_at_entry=1, show_copies_as_adds=show_copies_as
_adds_at_entry=0, use_git_diff_format=use_git_diff_format_at_entry=0, changelists=changelists_at_entry=0x1bed790, pool=pool_at_entry=0x1bf3228, callbacks=0x7f5866d0acc0 <diff_callbacks>) at subversion/libsvn_client/diff.c:2090
#6 0x00007f5866ad3b9a in svn_client_diff_peg6 (options=options_at_entry=0x0, path_or_url=0x1c41b10 "..", peg_revision=peg_revision_at_entry=0x7fff6cc773b0, start_revision=start_revision_at_entry=0x7fff6cc77568, end_revision=end_revisi
on_at_entry=0x7fff6cc77578, relative_to_dir=relative_to_dir_at_entry=0x0, depth=svn_depth_unknown, ignore_ancestry=1, no_diff_added=0, no_diff_deleted=0, show_copies_as_adds=show_copies_as_adds_at_entry=0, ignore_content_type=0, ignore
_properties=ignore_properties_at_entry=0, properties_only=0, use_git_diff_format=0, header_encoding=0x1 <error: Cannot access memory at address 0x1>, outstream=outstream_at_entry=0x1c418d0, errstream=errstream_at_entry=0x1c419a0, chang
elists=0x1bed790, ctx=ctx_at_entry=0x1bee980, pool=pool_at_entry=0x1bf3228) at subversion/libsvn_client/diff.c:2677
#7 0x000000000040bc59 in svn_cl__diff (os=<optimized out>, baton=<optimized out>, pool=0x1bed1f8) at subversion/svn/diff-cmd.c:441
#8 0x000000000041ad13 in sub_main (argc=argc_at_entry=5, argv=argv_at_entry=0x7fff6cc77878, pool=pool_at_entry=0x1bed1f8) at subversion/svn/svn.c:2878
#9 0x0000000000406c5d in main (argc=5, argv=0x7fff6cc77878) at subversion/svn/svn.c:2969

Here is an locals info for svn_ra_do_diff3 call:

#4 0x00007f5866ad0d73 in diff_repos_wc (path_or_url1=path_or_url1_at_entry=0x1c41b10 "..", revision1=revision1_at_entry=0x7fff6cc77568, peg_revision=peg_revision_at_entry=0x7fff6cc773b0, path2=path2_at_entry=0x1c41b10 "..", reverse=rever
se_at_entry=0, depth=depth_at_entry=svn_depth_unknown, ignore_ancestry=ignore_ancestry_at_entry=1, show_copies_as_adds=show_copies_as_adds_at_entry=0, use_git_diff_format=use_git_diff_format_at_entry=0, changelists=changelists_at_entry=0x1bed79
0, callbacks=callbacks_at_entry=0x7f5866d0acc0 <diff_callbacks>, callback_baton=callback_baton_at_entry=0x7fff6cc77190, cmd_baton=cmd_baton_at_entry=0x7fff6cc77190, ctx=ctx_at_entry=0x1bee980, scratch_pool=scratch_pool_at_entry=0x1bf3228, re
vision2=0x7fff6cc77578) at subversion/libsvn_client/diff.c:2027
(gdb) info locals
svn_err__temp = <optimized out>
url1 = 0x1bf41e8 "svn+ssh://arcadia.yandex.ru/arc/trunk/arcadia/yweb/robot/queuer"
anchor = 0x1bf3cd8 ""
anchor_url = 0x1bf40d8 "svn+ssh://arcadia.yandex.ru/arc/trunk/arcadia/yweb/robot/queuer/dumpdups"
target = 0x1bf3ce0 ".."
rev = 1403046
ra_session = 0x1c83770
diff_depth = svn_depth_unknown
reporter = <optimized out>
reporter_baton = <optimized out>
diff_editor = 0x1bf48c8
diff_edit_baton = 0x1bf4948
rev2_is_base = 0
server_supports_depth = 1
abspath_or_url1 = 0x1bf3420 "/fasthd/mvel/trunk/arcadia/yweb/robot/queuer"
abspath2 = 0x1bf3ac8 "/fasthd/mvel/trunk/arcadia/yweb/robot/queuer"
anchor_abspath = 0x1bf3e18 "/fasthd/mvel/trunk/arcadia/yweb/robot/queuer/dumpdups"
kind1 = svn_node_dir
kind2 = svn_node_dir
is_copy = 0
cf_revision = <optimized out>
cf_repos_relpath = <optimized out>
cf_repos_root_url = <optimized out>
pool = 0x1bf3228

... and from next stack:
svn_err__temp = 0

others are optimized out.

After repo updating this crash disappeared. Before that crash I updated 'arcadia/yweb/robot/queuer' subtree to different revision (1403046) a couple of times and rolled it back to 1403047.

-- 
Best regards, Mikhail Veltishchev [Software Dev @ Yandex]
mailto:dichlofos-mv_at_yandex.ru