test/format heap use after free on 4.2 branch

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Won't Fix
    • Priority: Major - P3
    • None
    • Affects Version/s: None
    • Component/s: None
    • None
    • None
    • None

      The old branches Jenkins job failed with a heap use after free error on the 4.2 branch. The error is http://build.wiredtiger.com:8080/job/wiredtiger-test-format-stress-sanitizer-old-branches/2763/console

      This is using the 4.2 changeset b52b16f. The ASAN stacks are:

      ==1974==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000572e8 at pc 0x000000adcaac bp 0x7f195dae8af0 sp 0x7f195dae8ae8
READ of size 8 at 0x6060000572e8 thread T12
    #0 0xadcaab in __wt_ref_info /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/btree.i:1079:24
    #1 0xadc5ca in __ref_is_leaf /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/btree/bt_walk.c:90:5
    #2 0xad58bf in __tree_walk_skip_count_callback /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/btree/bt_walk.c:598:35
    #3 0xad4af1 in __tree_walk_internal /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/btree/bt_walk.c:473:17
    #4 0xad5645 in __wt_tree_walk_skip /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/btree/bt_walk.c:622:9
    #5 0xa1f72c in __wt_btcur_next_random /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/btree/bt_random.c:580:9
    #6 0x60c75f in __wt_curfile_next_random /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/cursor/cur_file.c:120:5
    #7 0x524544 in random_kv /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/random.c:73:27
    #8 0x7f196aa3a6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
    #9 0x7f1969b6ca3e in clone /build/glibc-2ORdQG/glibc-2.27/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95

0x6060000572e8 is located 40 bytes inside of 56-byte region [0x6060000572c0,0x6060000572f8)
freed by thread T9 here:
    #0 0x4c7502 in free (/mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/t+0x4c7502)
    #1 0x732d68 in __wt_free_int /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/os_common/os_alloc.c:303:5
    #2 0x7af5ed in __wt_ref_addr_free /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/btree.i:647:9
    #3 0x7ad07f in __wt_ref_block_free /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/btree.i:1122:5
    #4 0x79c977 in __rec_write_wrapup /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/reconcile/rec_write.c:2202:9
    #5 0x78c69b in __reconcile /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/reconcile/rec_write.c:210:28
    #6 0x78afa3 in __wt_reconcile /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/reconcile/rec_write.c:103:11
    #7 0x69bdff in __evict_review /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/evict/evict_page.c:673:11
    #8 0x697dd4 in __wt_evict /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/evict/evict_page.c:149:5
    #9 0x679144 in __evict_page /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/evict/evict_lru.c:2238:5
    #10 0x675f56 in __wt_cache_eviction_worker /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/evict/evict_lru.c:2338:23
    #11 0x8b1416 in __wt_cache_eviction_check /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/include/cache.i:431:13
    #12 0x8b23ef in __wt_txn_rollback /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/txn/txn.c:1423:9
    #13 0x81a288 in __session_rollback_transaction /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/../src/session/session_api.c:1740:5
    #14 0x522c12 in rollback_transaction /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/ops.c:485:5
    #15 0x5161d1 in ops /mnt/data0/jenkins/workspace/wiredtiger-test-format-stress-sanitizer-old-branches/build_posix/test/format/../../../test/format/ops.c:1000:13
    #16 0x7f196aa3a6da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76d

            Assignee:
            Keith Smith
            Reporter:
            Susan LoVerso (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: