Bug ID: 5916
           Summary: lazymanifest can SIGSEGV when out of memory
           Product: Mercurial
           Version: 4.6
          Hardware: PC
                OS: Other
            Status: UNCONFIRMED
          Severity: bug
          Priority: normal
         Component: Mercurial

In order to work around hgweb leaking a ton of memory (see bug# 5913), I've
wrapped its startup with a ulimit:

        ulimit -v 200000
        exec hg serve --webdir-conf /repos/hgweb.config

This leads to malloc calls eventually failing.  One of the failure modes I've
seen is a SIGSEGV in lazymanifest. 

status: process terminated by SIGSEGV (Segmentation Fault), addr=11

Specifically in:`lazymanifest_dealloc+0x33()`lazymanifest_copy+0xe4()`PyEval_EvalFrameExReal+0x96e1()`PyEval_EvalFrameEx+0x19()`PyEval_EvalCodeEx+0x866()`PyEval_EvalFrameExReal+0x6877()`PyEval_EvalFrameEx+0x19()

The python version of the stack trace is:

fffffc7fee4f0de0 copy()
fffffc7fee4f0240 matches()
00000000020b7d30 diff()
0000000002bed070 _buildstatus()
0000000001654930 status()
00000000026147b0 status()
00000000027c41b0 diffhunks()
00000000013450b0 diffs()
00000000014747f0 flatten()
0000000000f41130 flatten()
0000000003a03370 increasingchunks()
00000000035797f0 sendresponse()
00000000027e72b0 run_wsgi()
0000000002645830 run_wsgi()
0000000002a235f0 do_hgweb()
000000000108e7b0 do_write()
0000000002634cf0 do_POST()
0000000001e43d70 do_GET()
0000000003380330 handle_one_request()
0000000002a322b0 handle()
0000000001a8c630 __init__()
fffffc7feca4ade0 __init__()
fffffc7feca55a50 finish_request()
0000000003761ab0 process_request_thread()
00000000038cb3b0 run()
00000000034810b0 __bootstrap_inner()
0000000002d6d330 __bootstrap()

lazymanifest_dealloc+0x33 is the 'if (self->lines[i].from_malloc)' condition. 
It turns out that at least in one of the crashes I've seen:

1. self != NULL
2. self->numlines == 0x8842
3. self->lines == NULL

The easiest fix is to check for self->lines being non-NULL when executing the
for-each-line loop.

You are receiving this mail because:
You are on the CC list for the bug.
Mercurial-devel mailing list

Reply via email to