Uploaded image for project: 'WiredTiger'
  1. WiredTiger
  2. WT-782

test/format failure: eviction read after free

    • Type: Icon: Task Task
    • Resolution: Done
    • WT2.1
    • Affects Version/s: None
    • Component/s: None
    • Labels:

      The test format stress job hit this error:

      http://mjc.homeunix.org:8180/job/wiredtiger-test-format-stress/2865/console

      [1385965168:185245][30449:0057d8e4aa7f0000], t, file:wt.wt, eviction-server: ../src/btree/bt_evict.c, 111: !F_ISSET_ATOMIC(page, WT_PAGE_EVICT_LRU)
      [1385965168:185488][30449:0057d8e4aa7f0000], t, file:wt.wt, eviction-server: aborting WiredTiger library
      /tmp/hudson7742815159657462089.sh: line 19: 30449 Aborted                 (core dumped) ./t
      + status=134
      + '[' -f RUNDIR/run ']'
      + cat RUNDIR/run
      ############################################
      #  RUN PARAMETERS
      ############################################
      firstfit=1
      # bitcnt not applicable to this run
      cache=8
      compression=none
      data_extend=0
      data_source=table
      delete_pct=19
      dictionary=0
      file_type=row-store
      hot_backups=0
      huffman_key=0
      huffman_value=0
      insert_pct=39
      internal_key_truncation=1
      internal_page_max=13
      key_gap=20
      key_max=75
      key_min=13
      leaf_page_max=10
      ops=100000
      prefix=1
      repeat_data_pct=23
      reverse=0
      rows=100000
      runs=100
      split_pct=79
      statistics=0
      threads=17
      value_max=1055
      value_min=14
      # wiredtiger_config not applicable to this run
      write_pct=62
      ############################################
      

      What's going on is that there is a checkpoint active in one thread. The eviction server has chosen an internal page from the eviction queue and has just locked one of its children, but the page pointer inside the locked WT_REF has already been freed:

      (gdb) where
      WT-3  0x0000000000440c1d in __wt_assert (session=0x1115030, error=0, file_name=0x65293e "../src/btree/bt_evict.c", line_number=111, fmt=0x65293b "%s") at ../src/support/err.c:470
      WT-4  0x000000000044cd30 in __wt_evict_list_clr_page (session=0x1115030, page=0x7faabc00caf0) at ../src/btree/bt_evict.c:111
      WT-5  0x0000000000462c35 in __rec_review (session=0x1115030, ref=0x7faaa0064358, page=0x7faabc00caf0, exclusive=0, merge=1, top=0, inmem_split=0x7faae4d84ca0, istree=0x7faae4d84c9c)
          at ../src/btree/rec_evict.c:315
      WT-6  0x0000000000462cf0 in __rec_review (session=0x1115030, ref=0x7faaa0064358, page=0x7faaa0064300, exclusive=0, merge=1, top=1, inmem_split=0x7faae4d84ca0, istree=0x7faae4d84c9c)
          at ../src/btree/rec_evict.c:336
      WT-7  0x0000000000462488 in __wt_rec_evict (session=0x1115030, page=0x7faaa0064300, exclusive=0) at ../src/btree/rec_evict.c:62
      WT-8  0x000000000044d532 in __wt_evict_page (session=0x1115030, page=0x7faaa0064300) at ../src/btree/bt_evict.c:348
      WT-9  0x000000000044e9b0 in __wt_evict_lru_page (session=0x1115030, is_app=0) at ../src/btree/bt_evict.c:1111
      WT-10 0x000000000044de4a in __evict_lru (session=0x1115030, clean=1) at ../src/btree/bt_evict.c:704
      WT-11 0x000000000044d284 in __evict_worker (session=0x1115030) at ../src/btree/bt_evict.c:258
      WT-12 0x000000000044ce7f in __wt_cache_evict_server (arg=0x1115030) at ../src/btree/bt_evict.c:164
      
      (gdb) print page
      $4 = (WT_PAGE *) 0x7faabc00caf0
      (gdb) print *page
      $5 = {parent = 0x7faabc05f650, ref = 0x7faabc00f940, u = {intl = {recno = 12370169555311111083, t = 0xabababababababab}, row = {d = 0xabababababababab, ins = 0xabababababababab,
            upd = 0xabababababababab}, col_fix = {recno = 12370169555311111083, bitf = 0xabababababababab <Address 0xabababababababab out of bounds>}, col_var = {
            recno = 12370169555311111083, d = 0xabababababababab, repeats = 0xabababababababab, nrepeats = 2880154539}}, dsk = 0xabababababababab, modify = 0xabababababababab,
        read_gen = 12370169555311111083, entries = 2880154539, memory_footprint = 2880154539, type = 171 '\253', flags_atomic = 171 '\253'}
      

            Assignee:
            michael.cahill@mongodb.com Michael Cahill (Inactive)
            Reporter:
            michael.cahill@mongodb.com Michael Cahill (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: