Details
Description
format heap use after free in __txn_commit_timestamps_assert
http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer/24549/console
==54435==ERROR: AddressSanitizer: heap-use-after-free on address 0x60b0001d1690 at pc 0x0000007a66b1 bp 0x7f63f49f7830 sp 0x7f63f49f7828
|
READ of size 8 at 0x60b0001d1690 thread T22
|
#0 0x7a66b0 in __txn_commit_timestamps_assert /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:743:32
|
#1 0x7a3a4d in __wt_txn_commit /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:867:2
|
#2 0x71d63f in __session_commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/session/session_api.c:1725:9
|
#3 0x52142f in commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:453:2
|
#4 0x51f045 in ops /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1020:4
|
#5 0x4dde52 in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4dde52)
|
#6 0x7f640383536c in start_thread (/lib64/libpthread.so.0+0x736c)
|
#7 0x7f6402a09b4e in __GI___clone (/lib64/libc.so.6+0x110b4e)
|
|
0x60b0001d1690 is located 0 bytes inside of 101-byte region [0x60b0001d1690,0x60b0001d16f5)
|
freed by thread T22 here:
|
#0 0x4d01e8 in __interceptor_free.localalias.0 (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4d01e8)
|
#1 0x654929 in __wt_free_int /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:327:2
|
#2 0x860352 in __wt_free_update_list /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:444:3
|
#3 0x861667 in __free_update /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:426:5
|
#4 0x85ea9e in __free_page_modify /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:211:4
|
#5 0x85cecd in __wt_page_out /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:112:3
|
#6 0x85c1e8 in __wt_ref_out /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_discard.c:44:2
|
#7 0x608bd5 in __evict_page_dirty_update /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_page.c:442:5
|
#8 0x6038de in __wt_evict /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_page.c:205:3
|
#9 0x6021b1 in __wt_page_release_evict /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/evict/evict_page.c:83:8
|
#10 0x847f2f in __wt_page_release /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/btree.i:1533:4
|
#11 0x8374ab in __cursor_reset /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/cursor.i:216:8
|
#12 0x836fd3 in __wt_btcur_reset /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:482:10
|
#13 0xa204e1 in __curfile_reset /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:172:8
|
#14 0x5c7e8a in __wt_cursor_cache /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_std.c:599:2
|
#15 0xa2cf63 in __curfile_cache /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:552:2
|
#16 0x5c9e60 in __wt_cursor_cache_release /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_std.c:685:2
|
#17 0xa2c22d in __curfile_close /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/cursor/cur_file.c:495:9
|
#18 0x7a642c in __txn_commit_timestamps_assert /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:731:6
|
#19 0x7a3a4d in __wt_txn_commit /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:867:2
|
#20 0x71d63f in __session_commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/session/session_api.c:1725:9
|
#21 0x52142f in commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:453:2
|
#22 0x51f045 in ops /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1020:4
|
#23 0x4dde52 in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4dde52)
|
|
previously allocated by thread T22 here:
|
#0 0x4d05a8 in calloc (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4d05a8)
|
#1 0x653170 in __wt_calloc /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_common/os_alloc.c:52:11
|
#2 0x9860c1 in __wt_update_alloc /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_modify.c:292:3
|
#3 0x8b52c2 in __las_page_instantiate /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:189:3
|
#4 0x8b7492 in __page_read_lookaside /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:429:2
|
#5 0x8af477 in __page_read /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:563:3
|
#6 0x8ac3b6 in __wt_page_in_func /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_read.c:687:4
|
#7 0x997cc7 in __wt_page_swap_func /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/include/btree.i:1715:8
|
#8 0x99375c in __wt_row_search /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/row_srch.c:463:14
|
#9 0x837d01 in __cursor_row_search /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:397:2
|
#10 0x837630 in __wt_btcur_search_uncommitted /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/btree/bt_cursor.c:503:2
|
#11 0x7a635b in __txn_commit_timestamps_assert /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:728:5
|
#12 0x7a3a4d in __wt_txn_commit /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:867:2
|
#13 0x71d63f in __session_commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/session/session_api.c:1725:9
|
#14 0x52142f in commit_transaction /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:453:2
|
#15 0x51f045 in ops /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:1020:4
|
#16 0x4dde52 in __asan::AsanThread::ThreadStart(unsigned long, __sanitizer::atomic_uintptr_t*) (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x4dde52)
|
|
Thread T22 created by T0 here:
|
#0 0x433890 in pthread_create (/work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/t+0x433890)
|
#1 0x670d00 in __wt_thread_create /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/os_posix/os_thread.c:30:2
|
#2 0x519857 in wts_ops /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/ops.c:173:3
|
#3 0x53428f in main /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/test/format/../../../test/format/t.c:221:5
|
#4 0x7f6402919889 in __libc_start_main (/lib64/libc.so.6+0x20889)
|
|
SUMMARY: AddressSanitizer: heap-use-after-free /work/jenkins/workspace/wiredtiger-test-format-stress-sanitizer/build_posix/../src/txn/txn.c:743:32 in __txn_commit_timestamps_assert
|
############################################
|
# RUN PARAMETERS
|
############################################
|
abort=0
|
alter=0
|
assert_commit_timestamp=1
|
assert_read_timestamp=0
|
auto_throttle=1
|
backups=1
|
bitcnt=4
|
bloom=1
|
bloom_bit_count=25
|
bloom_hash_count=20
|
bloom_oldest=0
|
cache=100
|
cache_minimum=20
|
checkpoints=on
|
checkpoint_log_size=183
|
checkpoint_wait=85
|
checksum=off
|
chunk_size=8
|
compaction=0
|
compression=none
|
data_extend=0
|
data_source=file
|
delete_pct=21
|
dictionary=0
|
direct_io=0
|
encryption=none
|
evict_max=5
|
file_type=row-store
|
firstfit=0
|
huffman_key=0
|
huffman_value=0
|
independent_thread_rng=0
|
in_memory=0
|
insert_pct=0
|
internal_key_truncation=1
|
internal_page_max=15
|
isolation=snapshot
|
key_gap=15
|
key_max=20
|
key_min=19
|
leaf_page_max=9
|
leak_memory=0
|
logging=0
|
logging_archive=0
|
logging_compression=none
|
logging_file_max=266694
|
logging_prealloc=1
|
long_running_txn=0
|
lsm_worker_threads=4
|
memory_page_max=2
|
merge_max=7
|
mmap=1
|
modify_pct=70
|
ops=0
|
prefix_compression=1
|
prefix_compression_min=1
|
prepare=1
|
quiet=1
|
read_pct=9
|
rebalance=1
|
repeat_data_pct=18
|
reverse=0
|
rows=1000000
|
runs=1
|
salvage=1
|
split_pct=88
|
statistics=0
|
statistics_server=1
|
threads=25
|
timer=4
|
timing_stress_aggressive_sweep=0
|
timing_stress_checkpoint=0
|
timing_stress_lookaside_sweep=0
|
timing_stress_split_1=0
|
timing_stress_split_2=0
|
timing_stress_split_3=0
|
timing_stress_split_4=0
|
timing_stress_split_5=0
|
timing_stress_split_6=0
|
timing_stress_split_7=0
|
timing_stress_split_8=0
|
transaction_timestamps=1
|
transaction-frequency=100
|
truncate=1
|
value_max=2694
|
value_min=8
|
verify=1
|
wiredtiger_config=
|
write_pct=0
|
############################################
|
Attachments
Issue Links
- is related to
-
WT-4957 Revert part of a change about when pages are queued for urgent eviction
-
- Closed
-