threads / discuss / 65131

Crash on git log with -L and -G on file rename

Subject: Crash on git log with -L and -G on file rename

## tl;dr

4 messages between Mar 3, 2026 and Mar 4, 2026.

replies: 3people: 4as markdown or json

Matthew Hughes· Mar 3, 2026, 20:42 UTC · lore
Hi,

I hit a crash (assertion error) running `git log` with both `-L` and `-G` under certain conditions. I've created script to reproduce the behaviour in a fresh git repo:

    #!/usr/bin/env bash
    set -o errexit
    git init .
    # Note: example is .rs file, but it should work with anything that -L understands
    echo "fn my_func() {}" > file.rs
    # 1. file named 'file.rs'
    git add file.rs
    git commit --message 'Add the file'
    # 2. separate branch with the file renamed
    git checkout -b some-branch
    git mv file.rs new_file.rs
    git commit --message 'Move the file'
    git checkout -
    git commit --allow-empty --message 'Some extra commit so we get a merge commit'
    # 3. merge: one parent has file.rs, the other has new_file.rs
    git merge --no-edit some-branch
    # 4. post merge, move the file back
    git mv new_file.rs file.rs
    git commit --message 'Move the file back'
    # 5. things go BOOM
    git log -L:my_func:file.rs -G '.'

I'm not sure if _every_ step in that script is necessary, but it's the simplest setup I could figure out to trigger the crash. Running that script I hit the error:

    git: line-log.c:1056: process_diff_filepair: Assertion `pair->two->oid_valid' failed.
    Aborted                    (core dumped) git log -L:my_func:file.rs -G '.'

The backtrace shows that the failed assertion occurs under `process_ranges_merge_commit`, so maybe there's an issue with the file being renamed on both sides of the merge?

The crash requires both flags to trigger, remove either and it will run fine.
I've tested the above on the `git` from my system package manager on Arch
Linux: git version 2.53.0, and one built from source at
2cc71917514657b93014134350864f4849edfc83 (the version of 'master' checked out
on my machine at the time). I don't think reproduction relies on any specific
config since I've had it trigger with both `GIT_CONFIG_GLOBAL` and
`GIT_CONFIG_SYSTEM` set to `/dev/null`

Just for reference, I originally triggered the bug in the `rustfmt` repo[1] (checked-out at cebab3e99259be82ff069e5ae89e91855d79e534) running:

    git log -G offset_left -L:format_trait:src/items.rs
Link: github.com/rust-lang/rustfmt [1]
Kristoffer Haugsbakk· Mar 3, 2026, 23:49 UTC · re: Matthew Hughes · lore

Re: Crash on git log with -L and -G on file rename

On Tue, Mar 3, 2026, at 21:42, Matthew Hughes wrote:
Show 64 quoted lines
> Hi,
>
> I hit a crash (assertion error) running `git log` with both `-L` and `-G` under
> certain conditions. I've created script to reproduce the behaviour in a fresh
> git repo:
>
>     #!/usr/bin/env bash
>
>     set -o errexit
>
>     git init .
>     # Note: example is .rs file, but it should work with anything that
> -L understands
>     echo "fn my_func() {}" > file.rs
>     # 1. file named 'file.rs'
>     git add file.rs
>     git commit --message 'Add the file'
>
>     # 2. separate branch with the file renamed
>     git checkout -b some-branch
>     git mv file.rs new_file.rs
>     git commit --message 'Move the file'
>
>     git checkout -
>     git commit --allow-empty --message 'Some extra commit so we get a
> merge commit'
>     # 3. merge: one parent has file.rs, the other has new_file.rs
>     git merge --no-edit some-branch
>
>     # 4. post merge, move the file back
>     git mv new_file.rs file.rs
>     git commit --message 'Move the file back'
>
>     # 5. things go BOOM
>     git log -L:my_func:file.rs -G '.'
>
> I'm not sure if _every_ step in that script is necessary, but it's the simplest
> setup I could figure out to trigger the crash. Running that script I hit the
> error:
>
>     git: line-log.c:1056: process_diff_filepair: Assertion
> `pair->two->oid_valid' failed.
>     Aborted                    (core dumped) git log -L:my_func:file.rs
> -G '.'
>
> The backtrace shows that the failed assertion occurs under
> `process_ranges_merge_commit`, so maybe there's an issue with the file being
> renamed on both sides of the merge?
>
> The crash requires both flags to trigger, remove either and it will run fine.
>
> I've tested the above on the `git` from my system package manager on Arch
> Linux: git version 2.53.0, and one built from source at
> 2cc71917514657b93014134350864f4849edfc83 (the version of 'master' checked out
> on my machine at the time). I don't think reproduction relies on any specific
> config since I've had it trigger with both `GIT_CONFIG_GLOBAL` and
> `GIT_CONFIG_SYSTEM` set to `/dev/null`
>
> Just for reference, I originally triggered the bug in the `rustfmt` repo[1]
> (checked-out at cebab3e99259be82ff069e5ae89e91855d79e534) running:
>
>     git log -G offset_left -L:format_trait:src/items.rs
>
> Link: github.com/rust-lang/rustfmt [1]
I was able to reproduce this on `master`, `next`, and `seen`.
• master: 50d063e3 (The 10th batch, 2026-03-03)
• seen: 62670724 (Merge branch 'ng/submodule-default-remote' into seen,
  2026-03-03)
• 87284122 (Sync with 'master', 2026-03-03)
Junio C Hamano· Mar 4, 2026, 02:06 UTC · re: Kristoffer Haugsbakk · lore

Re: Crash on git log with -L and -G on file rename

"Kristoffer Haugsbakk" <kristofferhaugsbakk@fastmail.com> writes:
Show 6 quoted lines
> I was able to reproduce this on `master`, `next`, and `seen`.
>
> • master: 50d063e3 (The 10th batch, 2026-03-03)
> • seen: 62670724 (Merge branch 'ng/submodule-default-remote' into seen,
>   2026-03-03)
> • 87284122 (Sync with 'master', 2026-03-03)

Not surprised, as I do not recall we made any changes to code paths around either -L nor -G for quite some time. I wouldn't be surprised if this were broken exactly the same way since the inception of the -L option, but bisecting might shed some lights on the root cause, perhaps?

Thanks.
Koji Nakamaru· Mar 4, 2026, 03:01 UTC · re: Matthew Hughes · lore

Re: Crash on git log with -L and -G on file rename

On Wed, Mar 4, 2026 at 5:42 AM Matthew Hughes <matthewhughes934@gmail.com> wrote:

Show 62 quoted lines
>
> Hi,
>
> I hit a crash (assertion error) running `git log` with both `-L` and `-G` under
> certain conditions. I've created script to reproduce the behaviour in a fresh
> git repo:
>
>     #!/usr/bin/env bash
>
>     set -o errexit
>
>     git init .
>     # Note: example is .rs file, but it should work with anything that -L understands
>     echo "fn my_func() {}" > file.rs
>     # 1. file named 'file.rs'
>     git add file.rs
>     git commit --message 'Add the file'
>
>     # 2. separate branch with the file renamed
>     git checkout -b some-branch
>     git mv file.rs new_file.rs
>     git commit --message 'Move the file'
>
>     git checkout -
>     git commit --allow-empty --message 'Some extra commit so we get a merge commit'
>     # 3. merge: one parent has file.rs, the other has new_file.rs
>     git merge --no-edit some-branch
>
>     # 4. post merge, move the file back
>     git mv new_file.rs file.rs
>     git commit --message 'Move the file back'
>
>     # 5. things go BOOM
>     git log -L:my_func:file.rs -G '.'
>
> I'm not sure if _every_ step in that script is necessary, but it's the simplest
> setup I could figure out to trigger the crash. Running that script I hit the
> error:
>
>     git: line-log.c:1056: process_diff_filepair: Assertion `pair->two->oid_valid' failed.
>     Aborted                    (core dumped) git log -L:my_func:file.rs -G '.'
>
> The backtrace shows that the failed assertion occurs under
> `process_ranges_merge_commit`, so maybe there's an issue with the file being
> renamed on both sides of the merge?
>
> The crash requires both flags to trigger, remove either and it will run fine.
>
> I've tested the above on the `git` from my system package manager on Arch
> Linux: git version 2.53.0, and one built from source at
> 2cc71917514657b93014134350864f4849edfc83 (the version of 'master' checked out
> on my machine at the time). I don't think reproduction relies on any specific
> config since I've had it trigger with both `GIT_CONFIG_GLOBAL` and
> `GIT_CONFIG_SYSTEM` set to `/dev/null`
>
> Just for reference, I originally triggered the bug in the `rustfmt` repo[1]
> (checked-out at cebab3e99259be82ff069e5ae89e91855d79e534) running:
>
>     git log -G offset_left -L:format_trait:src/items.rs
>
> Link: github.com/rust-lang/rustfmt [1]
>

The root cause appears to be that diff_might_be_rename() only checks diff_queued_diff.queue[i]->one. The following change can fix the issue.

diff --git a/line-log.c b/line-log.c
index eeaf68454e..2da7658ba9 100644
--- a/line-log.c
+++ b/line-log.c
@@ -834,6 +834,10 @@ static inline int diff_might_be_rename(void)
            /* fprintf(stderr, "diff_might_be_rename found creation
of: %s\n", */
            /*  diff_queued_diff.queue[i]->two->path); */
            return 1;
+       } else if (!DIFF_FILE_VALID(diff_queued_diff.queue[i]->two)) {
+           /* fprintf(stderr, "diff_might_be_rename found deletion
of: %s\n", */
+           /*  diff_queued_diff.queue[i]->one->path); */
+           return 1;
        }
    return 0;
 }

--
Koji Nakamaru

← back to recent threads