Summary

Calling the repository change-list tool against an Iceberg repository can segfault the Pharo image while Iceberg computes a working-copy diff.

Generic context

• Pharo 13.x image served through the MCP HTTP server
• MCP repository tools enabled
• Target repository was an Iceberg/libgit working copy
• The Git checkout had advanced outside the image before the repository tool queried changes, leaving the image-side repository reference stale

Evidence

The VM crash dump recorded a segmentation fault during the repository change-list path. Relevant stack excerpt:

Segmentation fault: 11
IceWorkingCopy>>diffToReferenceCommit
IceLibgitRepository(IceRepository)>>workingCopyDiff
MCPRepositoryDiffCommand>>execute
MCPToolListRepositoryChanges>>executeActionBlock:force:action:requestedContext:
MCPToolListRepositoryChanges>>executeParsedRequestFrom:do:onError:
MCP>>executeTool:named:withParams:

An older crash dump from the same image also showed a repository-search path involving MCPToolSearchRepositories and IceLibgitRepository>>remotes, so repository tools may need extra protection around libgit/Iceberg calls.

Expected behavior

The tool should return a structured error if Iceberg cannot compute the diff, or avoid the unsafe path. It should not be able to terminate the image.