Re: Segmentation fault in git-svn

[Peter Baumann <waste.manager@gmx.de>]

On Mon, Apr 16, 2007 at 03:17:55PM -0700, Steven Grimm wrote:
>  I expect this is really a libsvn bug, but git-svn triggers it, so I'm hoping 
>  someone else has run into and solved it, or at least that someone can 
>  reproduce it.
> 
>  If I try to clone the "memcached" public repository with the command line
> 
>   git-svn clone --branches=branches --trunk=trunk 
>  http://code.sixapart.com/svn/memcached
> 
>  it cranks along fine until revision 299, then dies with SIGSEGV. If I run it 
>  again, it appears to pick up where it left off, then dies again at revision 
>  399, then again at revision 499. (There are fewer than 600 revisions in that 
>  repo so it's anyone's guess if it'd die at 599 given the chance.)
> 
>  This happens on both a Linux box (amd64, FC4, svn version 1.4.3) and my Mac 
>  (Intel OS 10.4, svn version 1.2.3 from Fink), so at the very least it's not 
>  platform-specific. It also happens periodically on the private svn 
>  repository at my company, though not as predictably. On my Mac, I'm using 
>  the very latest git code from "master".
> 

I'm getting segfaults in git-svn, too.

This command segfaults reproducably in r55 while running

	git svn clone svn://svn.berlios.de/vermont vermont \
		-T trunk -b branches -t tags

I recompiled the debian subversion 1.4.3dfsg1-1 with debug support, to get a better
idea what went wrong.

Relevant output from running this beast under valgrind:
(full valgrind output available at [1])

[...]
r54 = f80e8d0ad785cae5a4abfb1fdd04b31167553ab0 (trunk)
	D	collector/src/testCollector.h
	M	collector/src/rcvIpfix.h
	M	collector/src/rcvMessage.c
	M	collector/src/common.c
	M	collector/src/rcvIpfix.c
	M	collector/src/common.h
r55 = 3fddc1de138e9457385ff43111bcaf6f82884525 (trunk)
==10403== 
==10403== Invalid read of size 1
==10403==    at 0x59F90A6: readbuf_getchar (marshal.c:285)
==10403==    by 0x59F90E6: readbuf_getchar_skip_whitespace (marshal.c:294)
==10403==    by 0x59FA0F3: svn_ra_svn_read_item (marshal.c:621)
==10403==    by 0x59FA628: svn_ra_svn_read_tuple (marshal.c:741)
==10403==    by 0x59FA906: svn_ra_svn_read_cmd_response (marshal.c:799)
==10403==    by 0x59ED81D: handle_auth_request (client.c:346)
==10403==    by 0x59F02B1: ra_svn_check_path (client.c:1284)
==10403==    by 0x59B7FD7: svn_ra_check_path (ra_loader.c:564)
==10403==    by 0x599DC93: _wrap_svn_ra_check_path (svn_ra.c:6019)
==10403==    by 0x80BDAD0: Perl_pp_entersub (in /usr/bin/perl)
==10403==    by 0x80BC3A8: Perl_runops_standard (in /usr/bin/perl)
==10403==    by 0x8063A1A: perl_run (in /usr/bin/perl)
==10403==  Address 0x6F6C6720 is not stack'd, malloc'd or (recently) free'd
==10403== 
==10403== Process terminating with default action of signal 11 (SIGSEGV)
==10403==  Access not within mapped region at address 0x6F6C6720
==10403==    at 0x59F90A6: readbuf_getchar (marshal.c:285)
==10403==    by 0x59F90E6: readbuf_getchar_skip_whitespace (marshal.c:294)
==10403==    by 0x59FA0F3: svn_ra_svn_read_item (marshal.c:621)
==10403==    by 0x59FA628: svn_ra_svn_read_tuple (marshal.c:741)
==10403==    by 0x59FA906: svn_ra_svn_read_cmd_response (marshal.c:799)
==10403==    by 0x59ED81D: handle_auth_request (client.c:346)
==10403==    by 0x59F02B1: ra_svn_check_path (client.c:1284)
==10403==    by 0x59B7FD7: svn_ra_check_path (ra_loader.c:564)
==10403==    by 0x599DC93: _wrap_svn_ra_check_path (svn_ra.c:6019)
==10403==    by 0x80BDAD0: Perl_pp_entersub (in /usr/bin/perl)
==10403==    by 0x80BC3A8: Perl_runops_standard (in /usr/bin/perl)
==10403==    by 0x8063A1A: perl_run (in /usr/bin/perl)
==10403== 
==10403== ERROR SUMMARY: 199 errors from 26 contexts (suppressed: 19 from 1)
==10403== malloc/free: in use at exit: 7,028,898 bytes in 129,440 blocks.
==10403== malloc/free: 325,184 allocs, 195,744 frees, 21,303,514 bytes allocated.
==10403== For counts of detected errors, rerun with: -v
==10403== searching for pointers to 129,440 not-freed blocks.
==10403== checked 7,214,984 bytes.
==10403== 
==10403== LEAK SUMMARY:
==10403==    definitely lost: 4,657 bytes in 118 blocks.
==10403==      possibly lost: 216 bytes in 13 blocks.
==10403==    still reachable: 7,024,025 bytes in 129,309 blocks.
==10403==         suppressed: 0 bytes in 0 blocks.
==10403== Use --leak-check=full to see details of leaked memory.

===========================================================================

subversion/libsvn_ra_svn/marshal.c:
[...]
280 static svn_error_t *readbuf_getchar(svn_ra_svn_conn_t *conn,
apr_pool_t *pool,
281                                     char *result)
282 {
283   if (conn->read_ptr == conn->read_end)
284     SVN_ERR(readbuf_fill(conn, pool));
285   *result = *conn->read_ptr++;	<-------- SEGFAULT happens here
286   return SVN_NO_ERROR;
287 }

===========================================================================

gdb backtrace:

r54 = f80e8d0ad785cae5a4abfb1fdd04b31167553ab0 (trunk)
        D       collector/src/testCollector.h
        M       collector/src/rcvIpfix.h
        M       collector/src/rcvMessage.c
        M       collector/src/common.c
        M       collector/src/rcvIpfix.c
        M       collector/src/common.h
r55 = 3fddc1de138e9457385ff43111bcaf6f82884525 (trunk)

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1210452288 (LWP 17426)]
0xb745f0a6 in readbuf_getchar (conn=0x877bf78, pool=0x88a6178, 
    result=0xbfea011f "\bL:F�L:F�X\001�\006F�x�w\bxa\212\bD\001�230��x�w\b�\212\b�F�\002")
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:285
285       *result = *conn->read_ptr++;
(gdb) bt
#0  0xb745f0a6 in readbuf_getchar (conn=0x877bf78, pool=0x88a6178, 
    result=0xbfea011f "\bL:F�L:F�X\001�\006F�x�w\bxa\212\bD\001�230��x�w\b�\212\b�F�\002")
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:285
#1  0xb745f0e7 in readbuf_getchar_skip_whitespace (conn=0x877bf78, pool=0x88a6178, 
    result=0xbfea011f "\bL:F�L:F�X\001�\006F�x�w\bxa\212\bD\001�230��x�w\b�\212\b�F�\002")
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:294
#2  0xb74600f4 in svn_ra_svn_read_item (conn=0x877bf78, pool=0x88a6178, item=0xbfea0144)
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:621
#3  0xb7460629 in svn_ra_svn_read_tuple (conn=0x877bf78, pool=0x88a6178, fmt=0xb7462607 "wl")
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:741
#4  0xb7460907 in svn_ra_svn_read_cmd_response (conn=0x877bf78, pool=0x88a6178, fmt=0xb7461372 "lc")
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/marshal.c:799
#5  0xb745381e in handle_auth_request (sess=0x877e1e8, pool=0x88a6178)
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/client.c:346
#6  0xb74562b2 in ra_svn_check_path (session=0x8778090, path=0x8899d48 "tags/collector-orig", rev=56, kind=0xbfea02c8, pool=0x88a6178)
    at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra_svn/client.c:1284
#7  0xb7495fd8 in svn_ra_check_path (session=0x8778090, path=0x8899d48 "tags/collector-orig", revision=56, kind=0xbfea02c8, 
    pool=0x88a6178) at /tmp/buildd/subversion-1.4.3dfsg1/subversion/libsvn_ra/ra_loader.c:564
#8  0xb74c2c94 in _wrap_svn_ra_check_path (my_perl=0x814e008, cv=0x85e1a94) at svn_ra.c:6019
#9  0x080bdad1 in Perl_pp_entersub ()
#10 0x080bc3a9 in Perl_runops_standard ()
#11 0x08063a1b in perl_run ()
#12 0x0805ffd1 in main ()
(gdb)

I'm a little lost in debuging this any further. So if anyone could give
me some advice ... feel free to contact me by mail or in #git
(nickname siprbaum)

-Peter

My system is debian etch with backported subversion + patch in [2] and git from
debian unstable/experimental
ii  git-core                        1.5.1.3-1
ii  git-svn                         1.5.1.3-1
ii  libsvn-perl                     1.4.3dfsg1-1
ii  libsvn1                         1.4.3dfsg1-1
ii  subversion                      1.4.3dfsg1-1

[1]: http://wwwcip.informatik.uni-erlangen.de/~siprbaum/git-svn-segfault.txt
[2]: http://svn.haxx.se/dev/archive-2007-01/0936.shtml