From: Steffen Prohaska Date: Sat, 21 Jul 2007 15:15:00 GMT Subject: segfault in diff-delta.c on mac os x (commit 8433669) Message-ID: 843366961cf14aad6490fbeb30f7b98f37f8833a may cause segfaults on Mac OS X. See backtrace below. I only observed the segfault with -O2 builds. I was not yet able to understand the reason causing the segfault. The situation is kind of strange. The for loop in line 302 shouldn't allow entry == 0 to ever happen. But maybe some more intricate corruption is taking place. Unfortunately I'm no longer able to reproduce the exact call stack because I wasn't aware of the details of when pruning takes place; and the repository changed in such a way that the segfault no longer happens. However, I experienced suspicious behaviour on other repositories during packing as well. I can probably create similar call stacks if needed. For now, I reverted 843366961cf14aad6490fbeb30f7b98f37f8833a for me. Steffen gcc --version i686-apple-darwin8-gcc-4.0.1 (GCC) 4.0.1 (Apple Computer, Inc. build 5250) Copyright (C) 2005 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Counting objects: 7530 Done counting 56361 objects. Deltifying 56361 objects... 69% (38890/56361) done Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000000 0x00048526 in create_delta (index=0x35d5000, trg_buf=0x35a0000, trg_size=214109, delta_size=0xbfffe83c, max_size=104893) at diff- delta.c:303 303 const unsigned char *ref = entry->ptr; (gdb) bt #0 0x00048526 in create_delta (index=0x35d5000, trg_buf=0x35a0000, trg_size=214109, delta_size=0xbfffe83c, max_size=104893) at diff- delta.c:303 #1 0x0002beb7 in prepare_pack (window=10, depth=50) at builtin-pack- objects.c:1293 #2 0x0002cd6e in cmd_pack_objects (argc=16, argv=0xbfffef78, prefix=0x0) at builtin-pack-objects.c:1709 #3 0x000020c9 in handle_internal_command (argc=16, argv=0xbfffef78, envp=0x84) at git.c:324 #4 0x00002669 in main (argc=16, argv=0xbfffef78, envp=0xbfffefbc) at git.c:393 (gdb) l 298 struct index_entry *entry; 299 val ^= U[data[-RABIN_WINDOW]]; 300 val = ((val << 8) | *data) ^ T[val >> RABIN_SHIFT]; 301 i = val & index->hash_mask; 302 for (entry = index->hash[i]; entry; entry = entry->next) { 303 const unsigned char *ref = entry->ptr; 304 const unsigned char *src = data; 305 unsigned int ref_size = ref_top - ref; 306 if (entry->val != val) 307 continue; (gdb) p entry $1 = (struct index_entry *) 0x0