Created attachment 10260 [details] don't sort -1 elements. There is a qsort in notify.c's change_notify_reply() function. We encountered numerous crashes in that function and after examining some of them, it looked like notify_buf->num_changes was -1 (so, no elements to sort). It also looks like notify_marshall_changes(), called immediately after qsort, expects/handles when notify_buf->num_changes == -1. We added protection to avoid calling qsort() when notify_buf->num_changes is less than 1 and the crashes we were experiencing stopped. Attached is the diff. Thanks!
Created attachment 10266 [details] git-am fix for master. Yeah, perfectly correct - we certainly call change_notify_reply() directly after setting notify_buf->num_changes to -1. As we already have a -1 check inside notify_marshall_changes() I think the best fix is to move the qsort() inside of notify_marshall_changes(), as it's only ever done just before calling notify_marshall_changes().
Fix went into master but need back-porting for 4.1.x, 4.0.x - bug me to get this done next week ! Jeremy.
OK, turns out this code (the timestamp qsort code) never got back-ported to 4.1 or 4.0. This means the bug only exists in the 4.2.x code, and therefore is already fixed :-). Jeremy.