There was a new stress test failure today:
http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress/5645/
The key part of the stack is here:
WT-4 0x00000000004360aa in __wt_free_int (session=0xc2e620, p_arg=0x7fcfec0ec048) at ../src/os_posix/os_alloc.c:237 WT-5 0x00000000004cb23e in __wt_free_ref (session=0xc2e620, page=0x7fcfec0e0e70, ref=0x7fcfec0ec030, free_pages=0) at ../src/btree/bt_discard.c:255
We're trying to free ref->addr, but it was an on-page address. The tree we're discarding is a checkpoint, and it seems as if page->dsk has been unmapped.
(gdb) print *page $4 = {u = {intl = {recno = 0, parent_ref = 0x7fcfec07a208, __index = 0x7fcfec0eaad0}, row = {d = 0x0, ins = 0x7fcfec07a208, upd = 0x7fcfec0eaad0, entries = 0}, col_fix = {recno = 0, bitf = 0x7fcfec07a208 "", entries = 3960384208}, col_var = {recno = 0, d = 0x7fcfec07a208, repeats = 0x7fcfec0eaad0, nrepeats = 0, entries = 0}}, dsk = 0x7fd025707c00, modify = 0x0, read_gen = 0, memory_footprint = 0, type = 6 '\006', flags_atomic = 4 '\004'} (gdb) print (uint8_t *)0x7fd025707c8f - (uint8_t *)page->dsk $7 = 143 (gdb) print *page->dsk Cannot access memory at address 0x7fd025707c00