Crash when analyzing zamger repository

[Peter Johansson]

Report from Vedran Ljubovic:

Hello,

I tried to register to post a ticket, but for some reason username svndigest password svndigest isn't accepted.

Svndigest 0.9.5 crashes when run on this public SVN repository: ​http://f.etf.unsa.ba/svn/zamger/trunk

Backtrace:

#0  0x0012d422 in __kernel_vsyscall ()
#1  0x00409651 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0x0040ca82 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0x0044049d in ?? () from /lib/tls/i686/cmov/libc.so.6
#4  0x0044a591 in ?? () from /lib/tls/i686/cmov/libc.so.6
#5  0x0044b80e in ?? () from /lib/tls/i686/cmov/libc.so.6
#6  0x00360741 in operator delete(void*) () from /usr/lib/libstdc++.so.6
#7  0x0808c1ed in __gnu_cxx::new_allocator<std::_Rb_tree_node<std::pair<long const, unsigned int> > >::deallocate (this=0xbfffe7a8, __x=0x8c4578c) at /usr/include/c++/4.4/ext/new_allocator.h:95
#8  std::_Rb_tree<long, std::pair<long const, unsigned int>, std::_Select1st<std::pair<long const, unsigned int> >, std::less<long>, std::allocator<std::pair<long const, unsigned int> > >::_M_put_node (this=0xbfffe7a8, __x=0x8c4578c) at /usr/include/c++/4.4/bits/stl_tree.h:363
#9  std::_Rb_tree<long, std::pair<long const, unsigned int>, std::_Select1st<std::pair<long const, unsigned int> >, std::less<long>, std::allocator<std::pair<long const, unsigned int> > >::_M_destroy_node (this=0xbfffe7a8, __x=0x8c4578c) at /usr/include/c++/4.4/bits/stl_tree.h:384
#10 std::_Rb_tree<long, std::pair<long const, unsigned int>, std::_Select1st<std::pair<long const, unsigned int> >, std::less<long>, std::allocator<std::pair<long const, unsigned int> > >::_M_erase
    (this=0xbfffe7a8, __x=0x8c4578c) at /usr/include/c++/4.4/bits/stl_tree.h:972
#11 0x0808c1e2 in std::_Rb_tree<long, std::pair<long const, unsigned int>, std::_Select1st<std::pair<long const, unsigned int> >, std::less<long>, std::allocator<std::pair<long const, unsigned int> > >::_M_erase (this=0xbfffede0, __x=0xbfffee18) at /usr/include/c++/4.4/bits/stl_tree.h:970
#12 0x0808d252 in void theplu::svndigest::sum<__gnu_cxx::__normal_iterator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >*, std::vector<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >, std::allocator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > > > > >, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> >, theplu::svndigest::PairValuePlusAssign<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > > >(__gnu_cxx::__normal_iterator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >*, std::vector<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >, std::allocator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > > > > >, __gnu_cxx::__normal_iterator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >*, std::vector<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >, std::allocator<std::pair<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > > > > >, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> >&, theplu::svndigest::PairValuePlusAssign<std::string, theplu::svndigest::Vector<unsigned int, theplu::svndigest::SumPolicy<unsigned int> > >) ()
#13 0x0808bbb1 in theplu::svndigest::Stats::plot (this=0x83d03e0, filename=..., linetype=..., 
    format=...) at Stats.cc:473
#14 0x0808bff5 in theplu::svndigest::Stats::plot (this=0x83d03e0, filename=..., linetype=...)
    at Stats.cc:415
#15 0x08069ab4 in theplu::svndigest::Directory::print_core (this=0x83d0060, stats_type=..., 
    user=..., line_type=..., log=...) at Directory.cc:207
#16 0x0807d52b in theplu::svndigest::Node::print (this=0x83d0060, verbose=false) at Node.cc:209
#17 0x08094748 in theplu::svndigest::SvndigestVisitor::leave (this=0xbffff6cc, dir=...)
    at SvndigestVisitor.cc:50
#18 0x08066ee4 in theplu::svndigest::Directory::traverse (this=0x83d0060, visitor=...)
    at Directory.cc:292
#19 0x08066ece in theplu::svndigest::Directory::traverse (this=0xbffff5e4, visitor=...)
    at Directory.cc:291
#20 0x080558c8 in main (argc=3, argv=0xbffff7e4) at svndigest.cc:127

[Peter Johansson]

I managed to reproduce the crash.

[Peter Johansson]

(In [1480]) add missing return statement in Vector+= and correct declaration of PairValuePlusAssign? (to return void). refs #515

[Peter Johansson]

With svndigest 0.9.6pre rev1480 the following assertion is triggered:

svndigest: Vector.h:62: T theplu::svndigest::Vector<T, Policy>::back() const [with T = unsigned int, Policy = theplu::svndigest::SumPolicy<unsigned int>]: Assertion `size()>0' failed.

[Peter Johansson]

Same assertion is triggered in trunk rev 1487, so the problem has not been solved [magically] in trunk since creation of 0.9 branch.

[Peter Johansson]

(In [1489]) fixes #515. avoid accessing zero-sized vector; reported by Vedran Ljubovic.