Beagle SCM

PATCH-004: be patch '#<sha>' (named-commit cherry-pick) ASAN container-overflow crash

be patch '#<sha>' — cherry-pick ONE named commit onto cur — ABORTS with an ASAN container-overflow (memory corruption) when the named commit is a SIBLING of cur (the two diverged at a common base). Live: from the beagle tree at d6f7e138 (DIS-053, off base 25851a5a), be patch '#ae64dc7f' (SUBS-036, also off 25851a5a — a sibling) → Container overflow / ==NNNN==ABORTING → BEDOGEXIT; the patch applied nothing (the tree was unharmed). So the named-commit cherry-pick / weave path has a real memory bug. The bootstrap binary is ASAN/debug, so it CAUGHT the overflow and aborted — a release build might corrupt silently. Found 2026-06-26 reconciling a fork. Kin of DIS-042's noted PATCH/RESOLVE-side fragility. Method: Issues.

Input

Context

• Live repro (bootstrap ASAN binary): beagle wt at d6f7e138 (off 25851a5a);

  be patch '#ae64dc7f' (ae64dc7f off 25851a5a, a sibling) → ASAN "Container overflow" abort + Error: BEDOGEXIT. No partial apply (tree clean after).

• A named-commit cherry-pick weaves the one commit against base = parent(theirs)

  (PATCH §"Merge base: full stack vs single commit"). The overflow is somewhere in that path — the graf weave / candidate set / a slice feed.

• DIS-042 already flagged PATCH/RESOLVE fragility (the branch-form ?A resolve

  shadowing); this is a DISTINCT hard CRASH in the #<sha> (cherry-pick) form.

• Impact: be patch '#<sha>' (cherry-pick, and the reconcile path that uses it) is

  unusable on a real divergent/sibling commit — it crashes instead of weaving.

Goals

• be patch '#<sha>' cherry-picks the named commit WITHOUT crashing — a clean weave

  for a sibling/divergent commit (disjoint OR overlapping files), at parity with the branch-form (?br) patch.

• A repro under test/ (cherry-pick a sibling commit) that ASAN-crashes today, green after.

Constraints

• The ASAN/debug build is the gate (it catches the overflow). Find the overflowing

  buffer (a graf weave/candidate buffer or an sFeed target) and size/grow it; use ABC bounds-checking, no fixed cap that just moves the cliff. Repro-first (CLAUDE §17).

WIP

Design decisions

• (open) Localize the container-overflow: run the ASAN repro and read the stack;

  likely graf/WEAVE.c / MERGE.c / JOIN.c / REBASE.c or the cherry-pick base-computation / candidate set.

TODOs

• Repro-first: hermetic two-branch fork (base v0; cur=C off v0; sibling T

  off v0); be patch '#<Tsha>' → ASAN container-overflow today (RED).

• Localize the overflow from the ASAN stack; fix the buffer sizing / bounds.
• Green: the cherry-pick lands T's delta onto cur; ASAN-clean; full ctest.

Blockers and bummers

• Landing the canonical be://localhost? ref needs the wire push (ssh),

  disabled here (WIRECLFL); keeper put //remote is "not implemented". Commit landed on the store's bare ? trunk as a clean ff (sibling of the other in-flight workers); be://localhost? advance is the human merge step (cf. the 213c9003 "COMMIT-005 merge" tip). GET-033.

Outcome

• FIXED + landed #3852ffe1 (ff onto trunk 213c9003). Root cause was

  NOT a weave container-overflow — it was a stack-use-after-scope: the #<sha> cherry path expanded a short hashlet into an if-scoped sha1hex hex40 and aliased frag into it, then resolve_cherry read frag after the block (PATCH.c:1195 ← :1608; RESOLVE.c:231). The full-40-hex pick (test 11) skipped the block, so only a hashlet repro'd. Fix: hoist hex40 to outlive resolve_cherry (sniff/PATCH.c ~1602). Repro test test/patch/36-cherry-pick-hashlet (RED→GREEN); live be patch '#ae64dc7f' onto d6f7e138 now clean; full ctest 348/348 ASAN-clean. be://localhost? push blocked (wire off) — see Blockers.