heap-use-after-free in __wt_row_modify

[2020/03/04 12:21:16.769]     ==4896==ERROR: AddressSanitizer: heap-use-after-free on address 0x6080008aab47 at pc 0x0000004c2996 bp 0x7f58dd8206f0 sp 0x7f58dd81fea0

[2020/03/04 12:21:16.769]     READ of size 47 at 0x6080008aab47 thread T22

[2020/03/04 12:21:16.769]         #0 0x4c2995 in __asan_memcpy /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3

[2020/03/04 12:21:16.769]         #1 0x57d42e in __wt_update_alloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:276:9

[2020/03/04 12:21:16.769]         #2 0x57aa9f in __wt_row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:102:13

[2020/03/04 12:21:16.769]         #3 0x9e5fa5 in __cursor_row_modify_v /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:405:13

[2020/03/04 12:21:16.769]         #4 0x9d96af in __btcur_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1305:15

[2020/03/04 12:21:16.769]         #5 0x9da527 in __wt_btcur_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1537:11

[2020/03/04 12:21:16.769]         #6 0x61c574 in __curfile_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/cursor/cur_file.c:446:5

[2020/03/04 12:21:16.769]         #7 0x509fef in row_reserve /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1280:16

[2020/03/04 12:21:16.769]         #8 0x504469 in ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:713:23

[2020/03/04 12:21:16.769]         #9 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

[2020/03/04 12:21:16.769]         #10 0x7f58e25e588e in clone /build/glibc-OTsEL5/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

[2020/03/04 12:21:16.769]     0x6080008aab47 is located 39 bytes inside of 86-byte region [0x6080008aab20,0x6080008aab76)

[2020/03/04 12:21:16.769]     freed by thread T1 here:

[2020/03/04 12:21:16.769]         #0 0x4c3562 in free /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:124:3

[2020/03/04 12:21:16.769]         #1 0x736f58 in __wt_free_int /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_common/os_alloc.c:301:5

[2020/03/04 12:21:16.769]         #2 0x9f950c in __wt_free_update_list /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:446:9

[2020/03/04 12:21:16.769]         #3 0x9fa833 in __free_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:428:13

[2020/03/04 12:21:16.769]         #4 0x9f78ea in __free_page_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:202:13

[2020/03/04 12:21:16.769]         #5 0x9f5cc0 in __wt_page_out /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:107:9

[2020/03/04 12:21:16.769]         #6 0x9f4fb8 in __wt_ref_out /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_discard.c:41:5

[2020/03/04 12:21:16.769]         #7 0x69420a in __evict_page_dirty_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_page.c:396:13

[2020/03/04 12:21:16.769]         #8 0x68f986 in __wt_evict /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_page.c:193:9

[2020/03/04 12:21:16.769]         #9 0x670402 in __evict_page /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:2246:5

[2020/03/04 12:21:16.769]         #10 0x669290 in __evict_lru_pages /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:1118:20

[2020/03/04 12:21:16.769]         #11 0x673ed1 in __evict_pass /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:715:19

[2020/03/04 12:21:16.769]         #12 0x6685ec in __evict_server /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:376:5

[2020/03/04 12:21:16.769]         #13 0x667d58 in __wt_evict_thread_run /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:288:15

[2020/03/04 12:21:16.769]         #14 0x8aa2c3 in __thread_run /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:31:9

[2020/03/04 12:21:16.769]         #15 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

[2020/03/04 12:21:16.769]     previously allocated by thread T22 here:

[2020/03/04 12:21:16.769]         #0 0x4c3ada in calloc /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:155:3

[2020/03/04 12:21:16.769]         #1 0x7356da in __wt_calloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_common/os_alloc.c:50:14

[2020/03/04 12:21:16.769]         #2 0x57d221 in __wt_update_alloc /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:273:5

[2020/03/04 12:21:16.769]         #3 0x57aa9f in __wt_row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/row_modify.c:102:13

[2020/03/04 12:21:16.769]         #4 0x9e5fa5 in __cursor_row_modify_v /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:405:13

[2020/03/04 12:21:16.769]         #5 0x9d8cc7 in __btcur_update /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1245:42

[2020/03/04 12:21:16.769]         #6 0x9d7edc in __wt_btcur_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/btree/bt_cursor.c:1495:15

[2020/03/04 12:21:16.769]         #7 0x620d40 in __curfile_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/cursor/cur_file.c:333:5

[2020/03/04 12:21:16.769]         #8 0x50bb2d in row_modify /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:1350:16

[2020/03/04 12:21:16.769]         #9 0x504a6b in ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:767:23

[2020/03/04 12:21:16.769]         #10 0x7f58e34b36da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)

[2020/03/04 12:21:16.769]     Thread T22 created by T0 here:

[2020/03/04 12:21:16.769]         #0 0x4ac1fd in pthread_create /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3

[2020/03/04 12:21:16.769]         #1 0x7557b5 in __wt_thread_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5

[2020/03/04 12:21:16.769]         #2 0x5013fb in wts_ops /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/ops.c:188:9

[2020/03/04 12:21:16.769]         #3 0x51d7b6 in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:280:13

[2020/03/04 12:21:16.769]         #4 0x7f58e24e5b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

[2020/03/04 12:21:16.769]     Thread T1 created by T0 here:

[2020/03/04 12:21:16.769]         #0 0x4ac1fd in pthread_create /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors.cc:210:3

[2020/03/04 12:21:16.769]         #1 0x7557b5 in __wt_thread_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/os_posix/os_thread.c:28:5

[2020/03/04 12:21:16.769]         #2 0x8a78ed in __thread_group_resize /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:201:9

[2020/03/04 12:21:16.769]         #3 0x8a8426 in __wt_thread_group_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/support/thread_group.c:285:5

[2020/03/04 12:21:16.769]         #4 0x66a89e in __wt_evict_create /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/evict/evict_lru.c:477:5

[2020/03/04 12:21:16.769]         #5 0x5d8161 in __wt_connection_workers /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/conn/conn_open.c:230:5

[2020/03/04 12:21:16.769]         #6 0x5985cc in wiredtiger_open /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/../src/conn/conn_api.c:2679:5

[2020/03/04 12:21:16.769]         #7 0x52961c in wts_open /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/wts.c:272:5

[2020/03/04 12:21:16.769]         #8 0x51d34a in main /data/mci/00c5c3b97f8d738e93e2ecd05541083c/wiredtiger/build_posix/test/format/../../../test/format/t.c:271:9

[2020/03/04 12:21:16.769]         #9 0x7f58e24e5b96 in __libc_start_main /build/glibc-OTsEL5/glibc-2.27/csu/../csu/libc-start.c:310

[2020/03/04 12:21:16.769]     SUMMARY: AddressSanitizer: heap-use-after-free /data/mci/6d25660c910a6c7a2027a8b66804ae0f/toolchain-builder/tmp/build-llvm.sh-A40/llvm/projects/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cc:23:3 in __asan_memcpy

[2020/03/04 12:21:16.769]     Shadow bytes around the buggy address:

[2020/03/04 12:21:16.769]       0x0c108010d510: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d520: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d530: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d540: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

[2020/03/04 12:21:16.769]       0x0c108010d550: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

[2020/03/04 12:21:16.769]     =>0x0c108010d560: fa fa fa fa fd fd fd fd[fd]fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d570: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00

[2020/03/04 12:21:16.769]       0x0c108010d580: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d590: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 00

[2020/03/04 12:21:16.769]       0x0c108010d5a0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fa

[2020/03/04 12:21:16.769]       0x0c108010d5b0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd

[2020/03/04 12:21:16.769]     Shadow byte legend (one shadow byte represents 8 application bytes):

[2020/03/04 12:21:16.769]       Addressable:           00

[2020/03/04 12:21:16.769]       Partially addressable: 01 02 03 04 05 06 07

[2020/03/04 12:21:16.769]       Heap left redzone:       fa

[2020/03/04 12:21:16.769]       Freed heap region:       fd

[2020/03/04 12:21:16.769]       Stack left redzone:      f1

[2020/03/04 12:21:16.769]       Stack mid redzone:       f2

[2020/03/04 12:21:16.769]       Stack right redzone:     f3

[2020/03/04 12:21:16.769]       Stack after return:      f5

[2020/03/04 12:21:16.769]       Stack use after scope:   f8

[2020/03/04 12:21:16.769]       Global redzone:          f9

[2020/03/04 12:21:16.769]       Global init order:       f6

[2020/03/04 12:21:16.769]       Poisoned by user:        f7

[2020/03/04 12:21:16.769]       Container overflow:      fc

[2020/03/04 12:21:16.769]       Array cookie:            ac

[2020/03/04 12:21:16.769]       Intra object redzone:    bb

[2020/03/04 12:21:16.769]       ASan internal:           fe

[2020/03/04 12:21:16.769]       Left alloca redzone:     ca

[2020/03/04 12:21:16.769]       Right alloca redzone:    cb

[2020/03/04 12:21:16.769]       Shadow gap:              cc

[2020/03/04 12:21:16.769]     ==4896==ABORTING