Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-12088

heap-use-after-free in __wt_lex_compare concurrency_simultaneous on 7.1

    • Type: Icon: Build Failure Build Failure
    • Resolution: Duplicate
    • Priority: Icon: Major - P3 Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • 2024-01-09 - I Grew Tired

      Task failing: concurrency_simultaneous on rhel80-debug-asan-classic-engine

      Reason: heap-use-after-free in __wt_lex_compare

      Backtrace - 

      [j0] ==30371==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000203050 at pc 0x560c5d1fc087 bp 0x7f0c0d0ee1b0 sp 0x7f0c0d0ee1a8
      ...
      [j0]     #0 0x560c5d1fc086 in __wt_lex_compare /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/third_party/wiredtiger/src/include/btree_cmp_inline.h:91:23
      [j0]     #1 0x560c5d1fc086 in __wt_compare /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/third_party/wiredtiger/src/include/btree_cmp_inline.h:107:17
      [j0]     #2 0x560c5d1fc086 in __wt_btcur_search_near /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/third_party/wiredtiger/src/btree/bt_cursor.c:1061:17
      [j0]     #3 0x560c5d333c47 in __curfile_search_near /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/third_party/wiredtiger/src/cursor/cur_file.c:359:5
      ...
      [j0]     #4 0x560c5cf6ebe6 in mongo::(anonymous namespace)::WiredTigerIndexCursorBase::seekWTCursorInternal(mongo::WiredTigerItem, bool)::'lambda'()::operator()() const /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/mongo/db/storage/wiredtiger/wiredtiger_index.cpp:1193:71
      [j0]     #5 0x560c5cf6ebe6 in int mongo::wiredTigerPrepareConflictRetry<mongo::(anonymous namespace)::WiredTigerIndexCursorBase::seekWTCursorInternal(mongo::WiredTigerItem, bool)::'lambda'()>(mongo::OperationContext*, mongo::(anonymous namespace)::WiredTigerIndexCursorBase::seekWTCursorInternal(mongo::WiredTigerItem, bool)::'lambda'()&&) /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/mongo/db/storage/wiredtiger/wiredtiger_prepare_conflict.h:77:15
      [j0]     #6 0x560c5cf6ebe6 in mongo::(anonymous namespace)::WiredTigerIndexCursorBase::seekWTCursorInternal(mongo::WiredTigerItem, bool) /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/mongo/db/storage/wiredtiger/wiredtiger_index.cpp:1193:19
      [j0]     #7 0x560c5cf6dd51 in mongo::(anonymous namespace)::WiredTigerIndexCursorBase::restore() /data/mci/fed03b90f39472fe5569ed42b9ef464c/src/src/mongo/db/storage/wiredtiger/wiredtiger_index.cpp:1082:36
      ...
      [j0]     #8 0x560c5f895201 in mongo::RequiresIndexStage::doRestoreStateRequiresCollection() /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/exec/requires_index_stage.cpp:70:5
      [j0]     #9 0x560c5f8905ea in mongo::RequiresCollectionStage::doRestoreState(mongo::RestoreContext const&) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/exec/requires_collection_stage.cpp:95:5
      [j0]     #10 0x560c5f87a2b0 in mongo::PlanStage::restoreState(mongo::RestoreContext const&) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/exec/plan_stage.cpp:53:16
      [j0]     #11 0x560c5f87a2b0 in mongo::PlanStage::restoreState(mongo::RestoreContext const&) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/exec/plan_stage.cpp:53:16
      ...
      [j0]     #12 0x560c5fb9a1de in mongo::PlanExecutorImpl::restoreStateWithoutRetrying(mongo::RestoreContext const&, mongo::Yieldable const*) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/query/plan_executor_impl.cpp:310:16
      [j0]     #13 0x560c5fb9a1de in mongo::PlanExecutorImpl::restoreState(mongo::RestoreContext const&) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/query/plan_executor_impl.cpp:292:9
      ...
      [j0]     #14 0x560c5dc34f16 in mongo::(anonymous namespace)::GetMoreCmd::Invocation::acquireLocksAndIterateCursor(mongo::OperationContext*, mongo::rpc::ReplyBuilderInterface*, mongo::ClientCursorPin&, mongo::CurOp*) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/commands/getmore_cmd.cpp:645:19
      [j0]     #15 0x560c5dc2e4da in mongo::(anonymous namespace)::GetMoreCmd::Invocation::run(mongo::OperationContext*, mongo::rpc::ReplyBuilderInterface*) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/commands/getmore_cmd.cpp:847:13
      ...
      [j0]     #16 0x560c66cf5897 in mongo::CommandHelpers::runCommandInvocation(mongo::OperationContext*, mongo::OpMsgRequest const&, mongo::CommandInvocation*, mongo::rpc::ReplyBuilderInterface*) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/commands.cpp:201:17
      [j0]     #17 0x560c66cf5897 in mongo::CommandHelpers::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>, bool)::$_0::operator()() const /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/commands.cpp:186:13
      [j0]     #18 0x560c66cf5897 in mongo::Future<mongo::future_details::UnwrappedTypeImpl<std::invoke_result<mongo::CommandHelpers::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>, bool)::$_0&&>::type>::type> mongo::makeReadyFutureWith<mongo::CommandHelpers::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>, bool)::$_0>(mongo::CommandHelpers::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>, bool)::$_0&&) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/util/future.h:1351:9
      [j0]     #19 0x560c66cf5897 in mongo::CommandHelpers::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>, bool) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/commands.cpp:185:16
      ...
      [j0]     #20 0x560c5813e7de in mongo::(anonymous namespace)::runCommandInvocation(std::shared_ptr<mongo::RequestExecutionContext>, std::shared_ptr<mongo::CommandInvocation>) /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/service_entry_point_common.cpp:221:12
      [j0]     #21 0x560c5812f34e in mongo::(anonymous namespace)::InvokeCommand::run()::$_2::operator()() const /data/mci/97d48be8431ff760fcbac4813ac79f8f/src/src/mongo/db/service_entry_point_common.cpp:945:23
      

        1. image-2023-12-11-13-51-03-389.png
          347 kB
          Jie Chen
        2. Screenshot 2023-12-06 at 3.48.04 pm.png
          118 kB
          Sid Mahajan

            Assignee:
            etienne.petrel@mongodb.com Etienne Petrel
            Reporter:
            siddhartha.mahajan@mongodb.com Sid Mahajan
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Created:
              Updated:
              Resolved: