annotate tests/test-revlog.t @ 29196:bf7b8157c483 stable

strip: invalidate phase cache after stripping changeset (issue5235)

When we remove a changeset from the changelog, the phase cache must be
invalidated, otherwise it could refer to changesets that are no longer in the
repo.

To reproduce the failure, I created an extension querying the phase cache after
the strip transaction is over.

To do that, I stripped two commits with a bookmark on one of them to force
another transaction (we open a transaction for moving bookmarks)
after the strip transaction.

Without the fix in this patch, the test leads to a stacktrace showing the issue:
      repair.strip(ui, repo, revs, backup)
    File "/Users/lcharignon/facebook-hg-rpms/hg-crew/mercurial/repair.py", line 205, in strip
      tr.close()
    File "/Users/lcharignon/facebook-hg-rpms/hg-crew/mercurial/transaction.py", line 44, in _active
      return func(self, *args, **kwds)
    File "/Users/lcharignon/facebook-hg-rpms/hg-crew/mercurial/transaction.py", line 490, in close
      self._postclosecallback[cat](self)
    File "$TESTTMP/crashstrip2.py", line 4, in test
      [repo.changelog.node(r) for r in repo.revs("not public()")]
    File "/Users/lcharignon/facebook-hg-rpms/hg-crew/mercurial/changelog.py", line 337, in node
      return super(changelog, self).node(rev)
    File "/Users/lcharignon/facebook-hg-rpms/hg-crew/mercurial/revlog.py", line 377, in node
      return self.index[rev][7]
  IndexError: revlog index out of range

The situation was encountered in inhibit (evolve's repo) where we would crash
following the volatile set invalidation submitted by Augie in
e6f490e328635312ee214a12bc7fd3c7d46bf9ce. Before his patch the issue was masked
as we were not accessing the phasecache after stripping a revision.

This bug uncovered another but in histedit (see explanation in issue5235).
I changed the histedit test accordingly to avoid fixing two things at once.

Test for CVE-2016-3630

  $ hg init

  >>> open("a.i", "w").write(
  ... """eJxjYGZgZIAAYQYGxhgom+k/FMx8YKx9ZUaKSOyqo4cnuKb8mbqHV5cBCVTMWb1Cwqkhe4Gsg9AD
  ... Joa3dYtcYYYBAQ8Qr4OqZAYRICPTSr5WKd/42rV36d+8/VmrNpv7NP1jQAXrQE4BqQUARngwVA=="""
  ... .decode("base64").decode("zlib"))

  $ hg debugindex a.i
     rev    offset  length  delta linkrev nodeid       p1           p2
       0         0      19     -1       2 99e0332bd498 000000000000 000000000000
       1        19      12      0       3 6674f57a23d8 99e0332bd498 000000000000
  $ hg debugdata a.i 1 2>&1 | egrep 'Error:.*decoded'
  (mercurial.mpatch.)?mpatchError: patch cannot be decoded (re)