If the insertion code path fails in the history store cursor, we can free the same update twice. We can easily reproduce this by injecting an error with a patch like this:
modified src/cursor/cur_hs.c @@ -914,6 +914,11 @@ __curhs_insert(WT_CURSOR *cursor) hs_upd = hs_tombstone; } + /* Randomly produce errors. */ + if (rand() % 5 == 0) + ret = EBUSY; + WT_ERR(ret); + do { WT_WITH_PAGE_INDEX(session, ret = __curhs_search(cbt, true)); WT_ERR(ret);