Description
heap-use-after-free on address in compaction
This one is real and reproducible.
http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer-ppc/1718/
./configure CCAS=gcc 'CC=clang -fsanitize=address' 'CFLAGS=-g -fno-omit-frame-pointer -I/usr/lib/gcc/ppc64le-redhat-linux/4.8.2/include' --enable-diagnostic --with-builtins=lz4,snappy,zlib --with-berkeleydb=/home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/db
|
=================================================================
|
==13388==ERROR: AddressSanitizer: heap-use-after-free on address 0x0a1000045a70 at pc 0x0000103f5e04 bp 0x3fff80f8c660 sp 0x3fff80f8c680
|
READ of size 8 at 0x0a1000045a70 thread T87
|
#0 0x103f5e00 in __wt_ref_info /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/include/btree.i:1070:18
|
#1 0x103f580c in __wt_compact_page_skip /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_compact.c:189:2
|
#2 0x104c5e44 in __tree_walk_internal /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_walk.c:491:6
|
#3 0x104c4714 in __wt_tree_walk /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_walk.c:678:10
|
#4 0x103f35ac in __wt_compact /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/btree/bt_compact.c:139:3
|
#5 0x10349074 in __compact_file /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/session/session_compact.c:235:3
|
#6 0x10346d9c in __wt_session_compact /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/../src/session/session_compact.c:312:4
|
#7 0x10120db4 in compact /home/jenkins/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-ppc/build_posix/test/format/../../../test/format/compact.c:66:14
|
#8 0x100eefe8 in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) /home/mcahill/src/llvm-3.8.1.src/projects/compiler-rt-3.8.1.src/lib/asan/asan_thread.cc:183
|
#9 0x100322e8 in asan_thread_start(void*) /home/mcahill/src/llvm-3.8.1.src/projects/compiler-rt-3.8.1.src/lib/asan/asan_interceptors.cc:228
|
#10 0x3fff98008940 in start_thread (/lib64/power8/libpthread.so.0+0x8940)
|
############################################
|
# RUN PARAMETERS
|
############################################
|
abort=0
|
auto_throttle=1
|
backups=0
|
bitcnt=8
|
bloom=1
|
bloom_bit_count=8
|
bloom_hash_count=8
|
bloom_oldest=1
|
cache=34
|
checkpoints=1
|
checksum=uncompressed
|
chunk_size=8
|
compaction=1
|
compression=lz4-noraw
|
data_extend=0
|
data_source=file
|
delete_pct=12
|
dictionary=0
|
direct_io=0
|
encryption=none
|
evict_max=5
|
file_type=row-store
|
firstfit=0
|
huffman_key=0
|
huffman_value=0
|
in_memory=0
|
insert_pct=6
|
internal_key_truncation=1
|
internal_page_max=9
|
isolation=random
|
key_gap=13
|
key_max=110
|
key_min=11
|
leaf_page_max=16
|
leak_memory=0
|
logging=1
|
logging_archive=1
|
logging_compression=lz4
|
logging_prealloc=1
|
long_running_txn=0
|
lsm_worker_threads=4
|
merge_max=17
|
mmap=1
|
ops=100000
|
prefix_compression=1
|
prefix_compression_min=3
|
quiet=1
|
repeat_data_pct=50
|
reverse=0
|
rows=100000
|
runs=1
|
rebalance=1
|
salvage=1
|
split_pct=68
|
statistics=0
|
statistics_server=0
|
threads=25
|
timer=20
|
transaction-frequency=6
|
value_max=3265
|
value_min=17
|
verify=1
|
wiredtiger_config=
|
write_pct=86
|
############################################
|