Johannes Schindelin <Johannes.Schindelin@xxxxxx> writes:
> As you said in another mail, Junio suggested using git-merge-file on the
> blobs themselves. This is a little tricky, since git-merge-file does not
> read blobs; only files. I'd do this:
>
> - in merge-recursive.c just before line 658 I'd add an
> fprintf(stderr, "xdl_merge: %s %s %s\n", sha1_to_hex(a->sha1),
> sha1_to_hex(o->sha1), sha1_to_hex(b->sha1));
> - run the merge until it segfaults
> - get the blobs by using the last three SHA1's in the output by
> $ git-show <sha1> > a # or "o" or "b"
> - $ git merge-file -p a o b >/dev/null
>
> This command line ensures that "a" is not edited, and you can repeat the
> merge as often as needed.
I'm seeing the problem here on Linux, I have attached a tarball with
a set of files from Wine that trigger the bug.
The gdb backtrace looks like this:
Core was generated by `git-merge-file -p a o b'.
Program terminated with signal 11, Segmentation fault.
#0 0x080b60be in xdl_refine_conflicts (xe1=0xbfcaf22c, xe2=0xbfcaf1a4, m=0x8106668, xpp=0xbfcaf348) at xdiff/xmerge.c:197
197 t1.ptr = (char *)xe1->xdf2.recs[m->i1]->ptr;
(gdb) bt
#0 0x080b60be in xdl_refine_conflicts (xe1=0xbfcaf22c, xe2=0xbfcaf1a4, m=0x8106668, xpp=0xbfcaf348) at xdiff/xmerge.c:197
#1 0x080b6843 in xdl_do_merge (xe1=0xbfcaf22c, xscr1=0x0, name1=0xbfcafbcf "a", xe2=0xbfcaf1a4, xscr2=0x0, name2=0xbfcafbd3 "b", level=2, xpp=0xbfcaf348, result=0xbfcaf34c) at xdiff/xmerge.c:351
#2 0x080b6b8c in xdl_merge (orig=0xbfcaf35c, mf1=0xbfcaf354, name1=0xbfcafbcf "a", mf2=0xbfcaf364, name2=0xbfcafbd3 "b", xpp=0xbfcaf348, level=2, result=0xbfcaf34c) at xdiff/xmerge.c:408
#3 0x08067887 in cmd_merge_file (argc=4, argv=0xbfcaf4b8, envp=0x0) at builtin-merge-file.c:43
#4 0x0804b0e5 in handle_internal_command (argc=5, argv=0xbfcaf4b4, envp=0xbfcaf4cc) at git.c:294
#5 0x0804b1e7 in main (argc=5, argv=0xbfcaf4b4, envp=0xbfcaf4cc) at git.c:331
(gdb) p *xe1
$1 = {xdf1 = {rcha = {head = 0x8105ca8, tail = 0x8107558, isize = 16, nsize = 1056, ancur = 0x8107558, sncur = 0x0, scurr = 0}, nrec = 259, hbits = 9, rhash = 0x81054a0, dstart = 36, dend = 257,
recs = 0x8105080, rchg = 0x80ff009 "", rindex = 0x8107988, nreff = 18, ha = 0x8107da0}, xdf2 = {rcha = {head = 0x8108370, tail = 0x81085b0, isize = 16, nsize = 176, ancur = 0x81085b0, sncur = 0x0,
scurr = 0}, nrec = 41, hbits = 6, rhash = 0x8108268, dstart = 36, dend = 39, recs = 0x81081b8, rchg = 0x80ff119 "", rindex = 0x8108670, nreff = 3, ha = 0x8108720}}
(gdb) p *xe2
$2 = {xdf1 = {rcha = {head = 0x81060d8, tail = 0x810aad0, isize = 16, nsize = 1056, ancur = 0x810aad0, sncur = 0x0, scurr = 0}, nrec = 259, hbits = 9, rhash = 0x8104878, dstart = 44, dend = 43,
recs = 0x8106b18, rchg = 0x8106509 "", rindex = 0x810b998, nreff = 0, ha = 0x810bdb0}, xdf2 = {rcha = {head = 0x810ce20, tail = 0x810db40, isize = 16, nsize = 1104, ancur = 0x810db40, sncur = 0x0,
scurr = 0}, nrec = 270, hbits = 9, rhash = 0x810c618, dstart = 44, dend = 54, recs = 0x810c1c8, rchg = 0x8106f39 "", rindex = 0x810dfa0, nreff = 8, ha = 0x810e3e0}}
(gdb) p *m
$3 = {next = 0x0, mode = 0, i1 = 41, i2 = 41, chg1 = 0, chg2 = 229}
And here's the Valgrind output:
==32758== Memcheck, a memory error detector.
==32758== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==32758== Using LibVEX rev 1658, a library for dynamic binary translation.
==32758== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==32758== Using valgrind-3.2.1-Debian, a dynamic binary instrumentation framework.
==32758== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==32758== For more details, rerun with: -v
==32758==
==32758== Use of uninitialised value of size 4
==32758== at 0x80B60BE: xdl_refine_conflicts (xmerge.c:197)
==32758== by 0x80B6842: xdl_do_merge (xmerge.c:351)
==32758== by 0x80B6B8B: xdl_merge (xmerge.c:408)
==32758== by 0x8067886: cmd_merge_file (builtin-merge-file.c:43)
==32758== by 0x804B0E4: handle_internal_command (git.c:294)
==32758== by 0x804B1E6: main (git.c:331)
==32758==
==32758== Invalid read of size 4
==32758== at 0x80B60BE: xdl_refine_conflicts (xmerge.c:197)
==32758== by 0x80B6842: xdl_do_merge (xmerge.c:351)
==32758== by 0x80B6B8B: xdl_merge (xmerge.c:408)
==32758== by 0x8067886: cmd_merge_file (builtin-merge-file.c:43)
==32758== by 0x804B0E4: handle_internal_command (git.c:294)
==32758== by 0x804B1E6: main (git.c:331)
==32758== Address 0x4 is not stack'd, malloc'd or (recently) free'd
==32758==
==32758== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==32758== Access not within mapped region at address 0x4
==32758== at 0x80B60BE: xdl_refine_conflicts (xmerge.c:197)
==32758== by 0x80B6842: xdl_do_merge (xmerge.c:351)
==32758== by 0x80B6B8B: xdl_merge (xmerge.c:408)
==32758== by 0x8067886: cmd_merge_file (builtin-merge-file.c:43)
==32758== by 0x804B0E4: handle_internal_command (git.c:294)
==32758== by 0x804B1E6: main (git.c:331)
Hope this helps,
--
Alexandre Julliard
julliard@xxxxxxxxxx
Attachment:
merge-file-segfault.tar.gz
Description: Binary data