Re: git-blame segfault

[Antoine Pelisse <apelisse@gmail.com>]

On Mon, Dec 2, 2013 at 1:57 PM, Markus Trippelsdorf
<markus@trippelsdorf.de> wrote:
> When git is compiled with current gcc and "-march=native"
> git-blame segfaults:
>
> For example:
>
>  % gdb --args /var/tmp/git/git-blame gcc/tree-object-size.c
> ...
> Program received signal SIGSEGV, Segmentation fault.
> 0x0000000000000000 in ?? ()
> (gdb) bt
> #0  0x0000000000000000 in ?? ()
> #1  0x000000000051240d in xdl_emit_hunk_hdr (s1=s1@entry=30, c1=<optimized out>, s2=s2@entry=30, c2=c2@entry=6, func=func@entry=0x7fffffffd2d8 "", funclen=0,
>     ecb=ecb@entry=0x7fffffffd580) at xdiff/xutils.c:460
> #2  0x0000000000512af7 in xdl_emit_diff (xe=0x7fffffffd390, xscr=<optimized out>, ecb=0x7fffffffd580, xecfg=0x7fffffffd590) at xdiff/xemit.c:237

xdl_emit_diff() should not be called, because xecfg->hunk_func should
be non-null and called instead. xld_emit_diff() is the one that needs
outf to be set.

> #3  0x0000000000510a5d in xdl_diff (mf1=mf1@entry=0x7fffffffd510, mf2=mf2@entry=0x7fffffffd520, xpp=xpp@entry=0x7fffffffd570, xecfg=xecfg@entry=0x7fffffffd590,
>     ecb=ecb@entry=0x7fffffffd580) at xdiff/xdiffi.c:601

Here we decide that xecfg->hunk_func is empty, and ef is set to xdl_emit_diff.

> #4  0x000000000050b005 in xdi_diff (mf1=<optimized out>, mf2=<optimized out>, xpp=xpp@entry=0x7fffffffd570, xecfg=xecfg@entry=0x7fffffffd590, xecb=xecb@entry=0x7fffffffd580)
>     at xdiff-interface.c:136
> #5  0x00000000004104df in diff_hunks (file_a=<optimized out>, file_b=<optimized out>, ctxlen=ctxlen@entry=0, hunk_func=hunk_func@entry=0x411320 <blame_chunk_cb>,
>     cb_data=cb_data@entry=0x7fffffffd830) at builtin/blame.c:105

As we can see in your code below, ecb.outf is not set here, because
it's not needed by hunk_func.
hunk_func is set to blame_chunck_cb, passed by the function below.

> #6  0x0000000000412b54 in pass_blame_to_parent (parent=0x11da810, target=0x11dab50, sb=0x7fffffffd6e0) at builtin/blame.c:815

diff_hunks() is called with blame_chunck_cb as hunk_func.

I think the best thing to do is to find out where xecfg->hunk_func
loses the blame_chunck_cb value to NULL. You could start with a
watchpoint.

>[...]
> 460             if (ecb->outf(ecb->priv, &mb, 1) < 0)
> (gdb) l
> 455             }
> 456             buf[nb++] = '\n';
> 457
> 458             mb.ptr = buf;
> 459             mb.size = nb;
> 460             if (ecb->outf(ecb->priv, &mb, 1) < 0)
> 461                     return -1;
> 462
> 463             return 0;
> 464     }
> (gdb) p *ecb
> $1 = {
>   priv = 0x7fffffffd830,
>   outf = 0x0
> }
>
> If I leave xecfg uninitialized in the following function the issue goes
> away.

Would that mean that gcc is doing some steps in the wrong order ? That
is setting xecfg.hunk_func and then emptying the structure ? I've
already had a similar bug, but that's very unfortunate.

> From builtin/blame.c:
>   94 static int diff_hunks(mmfile_t *file_a, mmfile_t *file_b, long ctxlen,
>   95                       xdl_emit_hunk_consume_func_t hunk_func, void *cb_data)
>   96 {
>   97         xpparam_t xpp = {0};
>   98         xdemitconf_t xecfg = {0};
>   99         xdemitcb_t ecb = {NULL};
>  100
>  101         xpp.flags = xdl_opts;
>  102         xecfg.ctxlen = ctxlen;
>  103         xecfg.hunk_func = hunk_func;
>  104         ecb.priv = cb_data;
>  105         return xdi_diff(file_a, file_b, &xpp, &xecfg, &ecb);
>  106 }
>  107