Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-443

Segfault in __wt_row_search

XMLWordPrintableJSON

    • Type: Icon: Task Task
    • Resolution: Done
    • WT1.5.0
    • Affects Version/s: None
    • Component/s: None
    • None

      I've assigned this to Michael because it appears to be in the btree code rather than the eviction code. Turf as appropriate.

      In testing various parameterization changes to the benchmark hang running with a small cache in WT-440, I bumped the cache up to the minimum required if LSM used 4 chunks minimum instead of 3 (about 8Mb). The read portion of that test does not hang, but goes slowly, as expected.

      In thinking that we're just moving the problem, I ran the same ~8Mb cache, but with 8 threads. With that, it takes a segfault in the overwrite part of the test.

      Here is the command line to execute, modulo your own env and pathname needs:

      env DYLD_LIBRARY_PATH=../wiredtiger/build_posix/.libs:../wiredtiger/build_posix/ext/compressors/snappy/.libs/ TEST_TMPDIR= ./db_bench_wiredtiger --threads=8 --cache_size=8450048 --benchmarks=fillrandom,overwrite

      Here is the stack:

      Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000050
[Switching to process 5763 thread 0x2b07]
0x00000001056ed4a7 in __wt_row_search (session=0x7fd1440026c0, cbt=0x7fd147327b90, is_modify=1) at row_srch.c:131
131		    page = btree->root_page; page->type == WT_PAGE_ROW_INT; ++depth) {
(gdb) bt
#0  0x00000001056ed4a7 in __wt_row_search (session=0x7fd1440026c0, cbt=0x7fd147327b90, is_modify=1) at row_srch.c:131
WT-1  0x00000001056af918 in __wt_btcur_insert (cbt=0x7fd147327b90) at bt_cursor.c:314
WT-2  0x00000001056fdc15 in __curfile_insert (cursor=0x7fd147327b90) at cur_file.c:175
WT-3  0x0000000105719c9b in __wt_metadata_update (session=0x7fd1440026c0, key=0x7fd143902ae0 "lsm:dbbench_wt-2", value=0x7fd1460af800 "bloom_config=(),file_config=(key_format=S,value_format=S,prefix_compression=false,checksum=off,internal_page_max=4kb,leaf_page_max=4kb,memory_page_max=8450048,block_compressor=snappy,key_format=u,valu"...) at meta_table.c:169
WT-4  0x0000000105712a83 in __wt_lsm_meta_write (session=0x7fd1440026c0, lsm_tree=0x7fd143902590) at lsm_meta.c:211
WT-5  0x0000000105715818 in __wt_lsm_tree_switch (session=0x7fd1440026c0, lsm_tree=0x7fd143902590) at lsm_tree.c:553
WT-6  0x000000010570e588 in __clsm_put (session=0x7fd1440026c0, clsm=0x7fd1474e5720, key=0x7fd1474e57d8, value=0x7fd1474e57f8) at lsm_cursor.c:849
WT-7  0x000000010570e013 in __clsm_insert (cursor=0x7fd1474e5720) at lsm_cursor.c:879
WT-8  0x000000010562102c in DoWrite (this=0x7fff5a5e3888, thread=0x7fd1460b6600, seq=false) at db_bench_wiredtiger.cc:898
WT-9  0x0000000105621556 in WriteRandom (this=0x7fff5a5e3888, thread=0x7fd1460b6600) at db_bench_wiredtiger.cc:849

      Here are some of the interesting data structures:

      (gdb) p/x *btree
$2 = {
  rwlock = 0x7fd143901930, 
  refcnt = 0xc, 
  q = {
    tqe_next = 0x7fd143902d00, 
    tqe_prev = 0x7fd1440013f8
  }, 
  name = 0x7fd143901290, 
  checkpoint = 0x0, 
  config = 0x7fd1439012b0, 
  stats = 0x7fd144014000, 
  maximum_depth = 0x3, 
  ckpt = 0x0, 
  type = 0x3, 
  key_format = 0x7fd1439002b0, 
  value_format = 0x7fd143900130, 
  bitcnt = 0x0, 
  collator = 0x0, 
  key_gap = 0xa, 
  allocsize = 0x200, 
  maxintlpage = 0x800, 
  maxintlitem = 0xc0, 
  maxleafpage = 0x100000, 
  maxleafitem = 0x18000, 
  maxmempage = 0x3200000, 
  huffman_key = 0x0, 
  huffman_value = 0x0, 
  checksum = 0x1, 
  dictionary = 0x0, 
  internal_key_truncate = 0x1, 
  prefix_compression = 0x1, 
  split_pct = 0x4b, 
  compressor = 0x0, 
  val_ovfl_lock = 0x7fd143901d20, 
  last_recno = 0x0, 
  root_page = 0x0, 
  modified = 0x1, 
  bulk_load_ok = 0x0, 
  block = 0x7fd144014600, 
  block_header = 0xc, 
  write_gen = 0xf24, 
  evict_page = 0x0, 
  evict_priority = 0x0, 
  lru_count = 0x0, 
  checkpointing = 0x0, 
  flags = 0xe0
}
(gdb) p/x *btree->root_page
Cannot access memory at address 0x0
(gdb) p depth
$3 = 2
(gdb) p/x *session
$4 = {
  iface = {
    connection = 0x7fd144001000, 
    close = 0x105732840, 
    reconfigure = 0x105732ed0, 
    open_cursor = 0x1057335a0, 
    create = 0x105733990, 
    compact = 0x105734050, 
    drop = 0x105734300, 
    rename = 0x105733bd0, 
    salvage = 0x105734520, 
    truncate = 0x105734770, 
    upgrade = 0x105734eb0, 
    verify = 0x105735100, 
    begin_transaction = 0x105735350, 
    commit_transaction = 0x1057355b0, 
    rollback_transaction = 0x105735840, 
    checkpoint = 0x105735a70, 
    msg_printf = 0x105735d30
  }, 
  active = 0x1, 
  cond = 0x7fd1426f4230, 
  name = 0x10574748f, 
  event_handler = 0x105761840, 
  btree = 0x7fd143901810, 
  btrees = {
    tqh_first = 0x7fd1478a3aa0, 
    tqh_last = 0x7fd1474e5868
  }, 
  cursor = 0x7fd147327b90, 
  cursors = {
    tqh_first = 0x7fd147327b90, 
    tqh_last = 0x7fd143b08980
  }, 
  metafile = 0x7fd143901810, 
  meta_track = 0x7fd14760e1c0, 
  meta_track_next = 0x0, 
  meta_track_sub = 0x0, 
  meta_track_alloc = 0x320, 
  meta_track_nest = 0x0, 
  tables = {
    tqh_first = 0x0, 
    tqh_last = 0x0
  }, 
  logrec_buf = {
    data = 0x0, 
    size = 0x0, 
    flags = 0x0, 
    mem = 0x0, 
    memsize = 0x0
  }, 
  logprint_buf = {
    data = 0x0, 
    size = 0x0, 
    flags = 0x0, 
    mem = 0x0, 
    memsize = 0x0
  }, 
  scratch = 0x7fd147634310, 
  scratch_alloc = 0xa, 
  scratch_track = 0x7fd1478b8060, 
  isolation = 0x1, 
  txn = {
    id = 0x96dae3, 
    isolation = 0x1, 
    snap_min = 0x96dadd, 
    snap_max = 0x96dae2, 
    snapshot = 0x7fd1426f42b0, 
    snapshot_count = 0x6, 
    oldest_snap_min = 0x968f2d, 
    mod = 0x7fd147591c90, 
    mod_alloc = 0x50, 
    mod_count = 0x2, 
    modref = 0x0, 
    modref_alloc = 0x0, 
    modref_count = 0x0, 
    eviction_fails = 0x0, 
    flags = 0x8
  }, 
  ncursors = 0x2, 
  reconcile = 0x7fd1473b51f0, 
  excl = 0x0, 
  excl_next = 0x0, 
  excl_allocated = 0x0, 
  syncop = 0x0, 
  syncop_ret = 0x0, 
  id = 0x8, 
  flags = 0x1, 
  hazard_size = 0xa, 
  nhazard = 0x1, 
  hazard = 0x7fd14403b000
}
(gdb) p/x *cbt
$6 = {
  iface = {
    session = 0x7fd1440026c0, 
    uri = 0x7fd143901290, 
    key_format = 0x7fd1439002b0, 
    value_format = 0x7fd143900130, 
    get_key = 0x105703090, 
    get_value = 0x105703fe0, 
    set_key = 0x105703220, 
    set_value = 0x1057043e0, 
    compare = 0x1056fcd90, 
    next = 0x1056fd0d0, 
    prev = 0x1056fd2f0, 
    reset = 0x1056fd400, 
    search = 0x1056fd510, 
    search_near = 0x1056fd700, 
    insert = 0x1056fd900, 
    update = 0x1056fdd80, 
    remove = 0x1056fe1f0, 
    close = 0x1056fe610, 
    q = {
      tqe_next = 0x7fd1474e5720, 
      tqe_prev = 0x7fd144002788
    }, 
    recno = 0x0, 
    raw_recno_buf = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 
    key = {
      data = 0x7fd143902ae0, 
      size = 0x11, 
      flags = 0x0, 
      mem = 0x0, 
      memsize = 0x0
    }, 
    value = {
      data = 0x7fd1460af800, 
      size = 0x1931, 
      flags = 0x0, 
      mem = 0x0, 
      memsize = 0x0
    }, 
    saved_err = 0x0, 
    flags = 0x168
  }, 
  btree = 0x7fd143901810, 
  page = 0x0, 
  slot = 0xffffffff, 
  ins_head = 0x0, 
  ins = 0x0, 
  ins_stack = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 
  next_stack = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 
  recno = 0x0, 
  write_gen = 0x0, 
  compare = 0x2, 
  last_standard_recno = 0x0, 
  row_iteration_slot = 0x0, 
  cip_saved = 0x0, 
  rip_saved = 0x0, 
  tmp = {
    data = 0x0, 
    size = 0x0, 
    flags = 0x0, 
    mem = 0x0, 
    memsize = 0x0
  }, 
  v = 0x0, 
  flags = 0x1
}

            Assignee:
            alexander.gorrod@mongodb.com Alexander Gorrod
            Reporter:
            sue.loverso@mongodb.com Susan LoVerso
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: