-
Type: Bug
-
Resolution: Done
-
Priority: Major - P3
-
Affects Version/s: None
-
Component/s: None
-
None
Clang reports:
60: file, row-store (611 seconds) ================================================================= ==23631==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c00001fe60 at pc 0x0000006dfe4e bp 0x7f2c67f97d50 sp 0x7f2c67f97d48 READ of size 1 at 0x60c00001fe60 thread T3147 #0 0x6dfe4d in __split_parent /home/ec2-user/work/wiredtiger/src/btree/bt_split.c:880:2 #1 0x6d7d17 in __split_insert /home/ec2-user/work/wiredtiger/src/btree/bt_split.c:1930:13 #2 0x6d7d17 in __wt_split_insert /home/ec2-user/work/wiredtiger/src/btree/bt_split.c:2003 #3 0x546b2d in __evict_review /home/ec2-user/work/wiredtiger/src/evict/evict_page.c:436:12 #4 0x546b2d in __wt_evict /home/ec2-user/work/wiredtiger/src/evict/evict_page.c:81 #5 0x542d60 in __evict_page /home/ec2-user/work/wiredtiger/src/evict/evict_lru.c:1488:2 #6 0x5419ad in __wt_cache_eviction_worker /home/ec2-user/work/wiredtiger/src/evict/evict_lru.c:1567:17 #7 0x7c749c in __wt_cache_eviction_check /home/ec2-user/work/wiredtiger/./src/include/cache.i:245:10 #8 0x7c749c in __cursor_enter /home/ec2-user/work/wiredtiger/./src/include/cursor.i:59 #9 0x7c749c in __curfile_enter /home/ec2-user/work/wiredtiger/./src/include/cursor.i:93 #10 0x7c749c in __cursor_func_init /home/ec2-user/work/wiredtiger/./src/include/cursor.i:266 #11 0x7c56f6 in __wt_btcur_search /home/ec2-user/work/wiredtiger/src/btree/bt_cursor.c:335:3 #12 0x7429bd in __curfile_search /home/ec2-user/work/wiredtiger/src/cursor/cur_file.c:200:2 #13 0x4f064b in row_remove /home/ec2-user/work/wiredtiger/test/format/ops.c:1155:13 #14 0x4f064b in ops /home/ec2-user/work/wiredtiger/test/format/ops.c:437 #15 0x7f2c7dee2dc4 in start_thread (/lib64/libpthread.so.0+0x7dc4) #16 0x7f2c7d0c7bdc in __clone (/lib64/libc.so.6+0xf6bdc) 0x60c00001fe60 is located 32 bytes inside of 120-byte region [0x60c00001fe40,0x60c00001feb8) freed by thread T3150 here: #0 0x4c6d92 in free (/mnt/fast/bostic/work/wiredtiger/test/format/t+0x4c6d92) #1 0x6a12cf in __wt_page_out /home/ec2-user/work/wiredtiger/src/btree/bt_discard.c:139:2 #2 0x546174 in __evict_page_dirty_update /home/ec2-user/work/wiredtiger/src/evict/evict_page.c:315:3 #3 0x546174 in __wt_evict /home/ec2-user/work/wiredtiger/src/evict/evict_page.c:124 #4 0x542d60 in __evict_page /home/ec2-user/work/wiredtiger/src/evict/evict_lru.c:1488:2 #5 0x5419ad in __wt_cache_eviction_worker /home/ec2-user/work/wiredtiger/src/evict/evict_lru.c:1567:17 #6 0x7c749c in __wt_cache_eviction_check /home/ec2-user/work/wiredtiger/./src/include/cache.i:245:10 #7 0x7c749c in __cursor_enter /home/ec2-user/work/wiredtiger/./src/include/cursor.i:59 #8 0x7c749c in __curfile_enter /home/ec2-user/work/wiredtiger/./src/include/cursor.i:93 #9 0x7c749c in __cursor_func_init /home/ec2-user/work/wiredtiger/./src/include/cursor.i:266 #10 0x7c7edd in __wt_btcur_search_near /home/ec2-user/work/wiredtiger/src/btree/bt_cursor.c:425:3 #11 0x74320b in __curfile_search_near /home/ec2-user/work/wiredtiger/src/cursor/cur_file.c:222:2 #12 0x4f3d22 in read_row /home/ec2-user/work/wiredtiger/test/format/ops.c:645:9 #13 0x4f04f3 in ops /home/ec2-user/work/wiredtiger/test/format/ops.c:494:8 #14 0x7f2c7dee2dc4 in start_thread (/lib64/libpthread.so.0+0x7dc4) previously allocated by thread T3121 here: #0 0x4c71eb in calloc (/mnt/fast/bostic/work/wiredtiger/test/format/t+0x4c71eb) #1 0x57a35b in __wt_calloc /home/ec2-user/work/wiredtiger/src/os_posix/os_alloc.c:60:11 #2 0x6b1014 in __wt_page_alloc /home/ec2-user/work/wiredtiger/src/btree/bt_page.c:63:2 #3 0x6b1d55 in __wt_page_inmem /home/ec2-user/work/wiredtiger/src/btree/bt_page.c:194:2 #4 0x6b8711 in __page_read /home/ec2-user/work/wiredtiger/src/btree/bt_read.c:394:2 #5 0x6b8711 in __wt_page_in_func /home/ec2-user/work/wiredtiger/src/btree/bt_read.c:488 #6 0x70055f in __wt_page_swap_func /home/ec2-user/work/wiredtiger/./src/include/btree.i:1310:8 #7 0x70055f in __tree_walk_internal /home/ec2-user/work/wiredtiger/src/btree/bt_walk.c:504 #8 0x7b5378 in __wt_btcur_next /home/ec2-user/work/wiredtiger/src/btree/bt_curnext.c:666:3 #9 0x741dbe in __curfile_next /home/ec2-user/work/wiredtiger/src/cursor/cur_file.c:113:13 #10 0x72224c in __wt_las_sweep /home/ec2-user/work/wiredtiger/src/cache/cache_las.c:334:27 #11 0x5244ad in __sweep_server /home/ec2-user/work/wiredtiger/src/conn/conn_sweep.c:285:4 #12 0x7f2c7dee2dc4 in start_thread (/lib64/libpthread.so.0+0x7dc4)
The problem is we've swapped the new page-index into place in the parent, after which eviction finds and evicts the page, after which the split code references the page->type field.
- is depended on by
-
SERVER-22388 WiredTiger changes for MongoDB 3.3.2
- Closed
-
SERVER-22570 WiredTiger changes for MongoDB 3.2.4
- Closed
- links to