If the insertion code path fails in the history store cursor, we can free the same update twice. We can easily reproduce this by injecting an error with a patch like this:
modified src/cursor/cur_hs.c
@@ -914,6 +914,11 @@ __curhs_insert(WT_CURSOR *cursor)
hs_upd = hs_tombstone;
}
+ /* Randomly produce errors. */
+ if (rand() % 5 == 0)
+ ret = EBUSY;
+ WT_ERR(ret);
+
do {
WT_WITH_PAGE_INDEX(session, ret = __curhs_search(cbt, true));
WT_ERR(ret);