<!-- 
RSS generated by JIRA (9.7.1#970001-sha1:2222b88b221c4928ef0de3161136cc90c8356a66) at Thu Feb 08 03:57:44 UTC 2024

It is possible to restrict the fields that are returned in this document by specifying the 'field' parameter in your request.
For example, to request only the issue key and summary append 'field=key&field=summary' to the URL of your request.
-->
<rss version="0.92" >
<channel>
    <title>MongoDB Jira</title>
    <link>https://jira.mongodb.org</link>
    <description>This file is an XML representation of an issue</description>
    <language>en-us</language>    <build-info>
        <version>9.7.1</version>
        <build-number>970001</build-number>
        <build-date>13-04-2023</build-date>
    </build-info>


<item>
            <title>[SERVER-21568]  use after free in bt_split.c</title>
                <link>https://jira.mongodb.org/browse/SERVER-21568</link>
                <project id="10000" key="SERVER">Core Server</project>
                    <description>&lt;p&gt;Running election timing tests with a workload, the Primary will crash, frequently, after oplog truncation. Output from an ASAN build:&lt;/p&gt;

&lt;p/&gt;
&lt;div id=&quot;syntaxplugin&quot; class=&quot;syntaxplugin&quot; style=&quot;border: 1px dashed #bbb; border-radius: 5px !important; overflow: auto; max-height: 30em;&quot;&gt;
&lt;table cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; border=&quot;0&quot; width=&quot;100%&quot; style=&quot;font-size: 1em; line-height: 1.4em !important; font-weight: normal; font-style: normal; color: black;&quot;&gt;
		&lt;tbody &gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;  margin-top: 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2187817-d20000| 2015-11-19T12:01:29.785-0500 D STORAGE  [WT RecordStoreThread: local.oplog.rs] Truncating the oplog between RecordId(6218908474747668007) and RecordId(6218908479042628027) to remove approximately 20263 records totaling to 4194441 bytes&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188061-d20000| 2015-11-19T12:01:29.786-0500 D STORAGE  [WT RecordStoreThread: local.oplog.rs] Finished truncating the oplog, it now contains approximately 206347 records totaling to 42713539 bytes&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188251-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:collection-11-570436650327984530 res 16&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188371-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:index-12-570436650327984530 res 16&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188486-d20000| 2015-11-19T12:01:30.007-0500 D STORAGE  [ftdc] WT queued drop of  table:index-13-570436650327984530 res 16&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188601-d20000| 2015-11-19T12:01:30.008-0500 D STORAGE  [ftdc] WT queued drop of  table:index-14-570436650327984530 res 16&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188716-d20000| 2015-11-19T12:01:30.008-0500 D STORAGE  [ftdc] WT queued drop of  table:index-15-570436650327984530 res 16&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188831-d20000| =================================================================&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2188905:d20000| ==27065== ERROR: AddressSanitizer: heap-use-after-free on address 0x6004000a4138 at pc 0x3f0f620 bp 0x7f05d763e290 sp 0x7f05d763e288&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189046-d20000| READ of size 8 at 0x6004000a4138 thread T79 &lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189098-d20000|     #0 0x3f0f61f in __split_parent /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:887&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189222-d20000|     #1 0x3f1514a in __split_multi /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:1935&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189346-d20000|     #2 0x3f1514a in __wt_split_multi /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/btree/bt_split.c:1978&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189473-d20000|     #3 0x3fec912 in __evict_page_dirty_update /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_page.c:293&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189610-d20000|     #4 0x3fec912 in __wt_evict /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_page.c:123&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189732-d20000|     #5 0x3fe2b29 in __evict_page /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:1467&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189856-d20000|     #6 0x3fe3719 in __evict_lru_pages /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:818&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2189984-d20000|     #7 0x3fe3719 in __evict_worker /home/grund/MongoDB/replcrsh/src/third_party/wiredtiger/src/evict/evict_lru.c:434&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2190109-d20000|     #8 0x7f0608a96b97 (/usr/lib/x86_64-linux-gnu/libasan.so.0+0x18b97)&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2190188-d20000|     #9 0x7f0607c3c181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2190286-d20000|     #10 0x7f060796947c in clone /build/buildd/eglibc-2.19/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:111&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;   margin-bottom: 10px;  width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;2190403-d20000| 0x6004000a4138 is located 8 bytes inside of 16-byte region [0x6004000a4130,0x6004000a4140)&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
			&lt;/tbody&gt;
&lt;/table&gt;
&lt;/div&gt;
&lt;p/&gt;

&lt;p&gt;db version v3.2.0-rc3-49-ga0771ea&lt;br/&gt;
git version: a0771ea5ec1b44537d3c409e3d712db24fd8e6bb&lt;/p&gt;

&lt;p&gt;mongod has the fix for &lt;a href=&quot;https://jira.mongodb.org/browse/WT-2224&quot; title=&quot;backup_restore.js fails with tcmalloc invalid free pointer in __wt_split_multi&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2224&quot;&gt;&lt;del&gt;WT-2224&lt;/del&gt;&lt;/a&gt;&lt;/p&gt;</description>
                <environment></environment>
        <key id="240290">SERVER-21568</key>
            <summary> use after free in bt_split.c</summary>
                <type id="1" iconUrl="https://jira.mongodb.org/secure/viewavatar?size=xsmall&amp;avatarId=14703&amp;avatarType=issuetype">Bug</type>
                                            <priority id="3" iconUrl="https://jira.mongodb.org/images/icons/priorities/major.svg">Major - P3</priority>
                        <status id="6" iconUrl="https://jira.mongodb.org/images/icons/statuses/closed.png" description="The issue is considered finished, the resolution is correct. Issues which are closed can be reopened.">Closed</status>
                    <statusCategory id="3" key="done" colorName="success"/>
                                    <resolution id="9">Done</resolution>
                                        <assignee username="michael.cahill@mongodb.com">Michael Cahill</assignee>
                                    <reporter username="michael.grundy">Michael Grundy</reporter>
                        <labels>
                    </labels>
                <created>Thu, 19 Nov 2015 21:22:09 +0000</created>
                <updated>Mon, 7 Dec 2015 02:00:49 +0000</updated>
                            <resolved>Fri, 20 Nov 2015 06:05:47 +0000</resolved>
                                    <version>3.2.0-rc3</version>
                                    <fixVersion>3.2.0-rc4</fixVersion>
                                    <component>Storage</component>
                                        <votes>0</votes>
                                    <watches>7</watches>
                                                                                                                <comments>
                            <comment id="1103003" author="xgen-internal-githook" created="Wed, 2 Dec 2015 11:32:47 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;michaelcahill&apos;, u&apos;name&apos;: u&apos;Michael Cahill&apos;, u&apos;email&apos;: u&apos;michael.cahill@mongodb.com&apos;}
&lt;p&gt;Message: Import wiredtiger-wiredtiger-mongodb-3.0.7-20-g27d0cbd.tar.gz from wiredtiger branch mongodb-3.0&lt;/p&gt;

&lt;p&gt;ref: deb2d81..27d0cbd&lt;/p&gt;

&lt;p&gt;6feaa28 &lt;a href=&quot;https://jira.mongodb.org/browse/WT-2251&quot; title=&quot;Memory leak from split code&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2251&quot;&gt;&lt;del&gt;WT-2251&lt;/del&gt;&lt;/a&gt; Fix leaf of deleted page addresses.&lt;br/&gt;
1da2d3a &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Fix a use-after-free.&lt;br/&gt;
4228295 &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21553&quot; title=&quot;Oplog grows to 3x configured size&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21553&quot;&gt;&lt;del&gt;SERVER-21553&lt;/del&gt;&lt;/a&gt; Free blocks during reverse splits.&lt;br/&gt;
0398515 &lt;a href=&quot;https://jira.mongodb.org/browse/WT-2241&quot; title=&quot;Improve performance of transaction ID allocation&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2241&quot;&gt;&lt;del&gt;WT-2241&lt;/del&gt;&lt;/a&gt; Use a lock to protect transaction ID allocation.&lt;br/&gt;
06a5c7b &lt;a href=&quot;https://jira.mongodb.org/browse/WT-2237&quot; title=&quot;Make committed changes visible immediately&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2237&quot;&gt;&lt;del&gt;WT-2237&lt;/del&gt;&lt;/a&gt; Avoid yields if we race allocating transaction IDs.&lt;br/&gt;
16a418b &lt;a href=&quot;https://jira.mongodb.org/browse/WT-2237&quot; title=&quot;Make committed changes visible immediately&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2237&quot;&gt;&lt;del&gt;WT-2237&lt;/del&gt;&lt;/a&gt; Have threads publish unique transaction IDs so that updates always become visible immediately on commit.&lt;br/&gt;
Branch: v3.0&lt;br/&gt;
&lt;a href=&quot;https://github.com/mongodb/mongo/commit/eb8bc24a0d36b673022faa83976a4b33bc8f676b&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/mongodb/mongo/commit/eb8bc24a0d36b673022faa83976a4b33bc8f676b&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1102982" author="xgen-internal-githook" created="Wed, 2 Dec 2015 11:00:56 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;agorrod&apos;, u&apos;name&apos;: u&apos;Alex Gorrod&apos;, u&apos;email&apos;: u&apos;alexander.gorrod@mongodb.com&apos;}
&lt;p&gt;Message: &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Fix a use after-free&lt;/p&gt;

&lt;p&gt;(cherry picked from commit 2d01a566)&lt;/p&gt;

&lt;p&gt;Conflicts:&lt;br/&gt;
	src/btree/bt_split.c&lt;br/&gt;
Branch: mongodb-3.0&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/1da2d3a517392d71e13b7ecdeaa97b01a2627d2d&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/1da2d3a517392d71e13b7ecdeaa97b01a2627d2d&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093980" author="michael.cahill" created="Fri, 20 Nov 2015 06:05:47 +0000"  >&lt;p&gt;Should be fixed by &lt;a href=&quot;https://github.com/mongodb/mongo/commit/fb959fb6020ade800db8674b598a04a1ab4c7e67&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/mongodb/mongo/commit/fb959fb6020ade800db8674b598a04a1ab4c7e67&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093922" author="xgen-internal-githook" created="Fri, 20 Nov 2015 03:42:40 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;agorrod&apos;, u&apos;name&apos;: u&apos;Alex Gorrod&apos;, u&apos;email&apos;: u&apos;alexander.gorrod@mongodb.com&apos;}
&lt;p&gt;Message: Merge pull request #2323 from wiredtiger/&lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Fix a use after-free&lt;br/&gt;
Branch: develop&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/2d01a566ba7b3576cb5b45af55479b3c06995589&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/2d01a566ba7b3576cb5b45af55479b3c06995589&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093921" author="xgen-internal-githook" created="Fri, 20 Nov 2015 03:42:39 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;agorrod&apos;, u&apos;name&apos;: u&apos;Alex Gorrod&apos;, u&apos;email&apos;: u&apos;alexander.gorrod@mongodb.com&apos;}
&lt;p&gt;Message: Merge pull request #2323 from wiredtiger/&lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;&lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Fix a use after-free&lt;br/&gt;
Branch: develop&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/2d01a566ba7b3576cb5b45af55479b3c06995589&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/2d01a566ba7b3576cb5b45af55479b3c06995589&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093920" author="xgen-internal-githook" created="Fri, 20 Nov 2015 03:42:38 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;michaelcahill&apos;, u&apos;name&apos;: u&apos;Michael Cahill&apos;, u&apos;email&apos;: u&apos;michael.cahill@mongodb.com&apos;}
&lt;p&gt;Message: &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Free page_del information in refs causing reverse splits.&lt;br/&gt;
Branch: develop&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/d7ac553f8e4ac466b7f48f086345b034a8b33a23&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/d7ac553f8e4ac466b7f48f086345b034a8b33a23&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093919" author="xgen-internal-githook" created="Fri, 20 Nov 2015 03:42:37 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;michaelcahill&apos;, u&apos;name&apos;: u&apos;Michael Cahill&apos;, u&apos;email&apos;: u&apos;michael.cahill@mongodb.com&apos;}
&lt;p&gt;Message: &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Free deleted page structures as soon as possible.&lt;/p&gt;

&lt;p&gt;The ref-&amp;gt;page_del structure can be freed as soon as it becomes globally visible.  Do that when we have the ref locked to avoid unnecessarily spinning on the page state.&lt;br/&gt;
Branch: develop&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/ead5ddc8e2c32af7e3e7eeaeacc6ffdf7986833b&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/ead5ddc8e2c32af7e3e7eeaeacc6ffdf7986833b&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093918" author="xgen-internal-githook" created="Fri, 20 Nov 2015 03:42:36 +0000"  >&lt;p&gt;Author:&lt;/p&gt;
{u&apos;username&apos;: u&apos;michaelcahill&apos;, u&apos;name&apos;: u&apos;Michael Cahill&apos;, u&apos;email&apos;: u&apos;michael.cahill@mongodb.com&apos;}
&lt;p&gt;Message: &lt;a href=&quot;https://jira.mongodb.org/browse/SERVER-21568&quot; title=&quot; use after free in bt_split.c&quot; class=&quot;issue-link&quot; data-issue-key=&quot;SERVER-21568&quot;&gt;&lt;del&gt;SERVER-21568&lt;/del&gt;&lt;/a&gt; Fix a use after-free.&lt;/p&gt;

&lt;p&gt;If a page was truncated, then subsequently there were more inserts onto that page so it was reinstantiated and the page ended up splitting, WiredTiger would attempt to free a data structure twice.&lt;br/&gt;
Branch: develop&lt;br/&gt;
&lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/commit/244aca5ca73e694b809e551ddf2e691a9d040aac&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/commit/244aca5ca73e694b809e551ddf2e691a9d040aac&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093900" author="michael.cahill" created="Fri, 20 Nov 2015 02:27:41 +0000"  >&lt;p&gt;CR: &lt;a href=&quot;https://github.com/wiredtiger/wiredtiger/pull/2323&quot; class=&quot;external-link&quot; target=&quot;_blank&quot; rel=&quot;nofollow noopener&quot;&gt;https://github.com/wiredtiger/wiredtiger/pull/2323&lt;/a&gt;&lt;/p&gt;</comment>
                            <comment id="1093643" author="michael.grundy@10gen.com" created="Thu, 19 Nov 2015 21:56:21 +0000"  >&lt;p&gt;Rolling back the majority write that was in flight when the primary was stopped might be related. I wasn&apos;t able to reproduce this in a simpler test case that didn&apos;t have the primary being stopped.&lt;/p&gt;</comment>
                            <comment id="1093608" author="dan@10gen.com" created="Thu, 19 Nov 2015 21:28:04 +0000"  >&lt;p&gt;&lt;a href=&quot;https://jira.mongodb.org/browse/WT-2224&quot; title=&quot;backup_restore.js fails with tcmalloc invalid free pointer in __wt_split_multi&quot; class=&quot;issue-link&quot; data-issue-key=&quot;WT-2224&quot;&gt;&lt;del&gt;WT-2224&lt;/del&gt;&lt;/a&gt;?&lt;/p&gt;</comment>
                    </comments>
                <issuelinks>
                            <issuelinktype id="10011">
                    <name>Depends</name>
                                            <outwardlinks description="depends on">
                                        <issuelink>
            <issuekey id="235857">WT-2224</issuekey>
        </issuelink>
                            </outwardlinks>
                                                                <inwardlinks description="is depended on by">
                                        <issuelink>
            <issuekey id="239213">SERVER-21442</issuekey>
        </issuelink>
            <issuelink>
            <issuekey id="212396">WT-1973</issuekey>
        </issuelink>
                            </inwardlinks>
                                    </issuelinktype>
                    </issuelinks>
                <attachments>
                            <attachment id="99073" name="d20000-afterfix-3.log" size="16369" author="michael.grundy" created="Thu, 19 Nov 2015 21:22:09 +0000"/>
                            <attachment id="99072" name="ett_load.diff" size="8970" author="michael.grundy" created="Thu, 19 Nov 2015 21:22:09 +0000"/>
                    </attachments>
                <subtasks>
                    </subtasks>
                <customfields>
                                                <customfield id="customfield_10050" key="com.atlassian.jira.toolkit:comments">
                        <customfieldname># Replies</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>11.0</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_10011" key="com.atlassian.jira.plugin.system.customfieldtypes:radiobuttons">
                        <customfieldname>Backwards Compatibility</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10038"><![CDATA[Fully Compatible]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                            <customfield id="customfield_10055" key="com.atlassian.jira.ext.charting:firstresponsedate">
                        <customfieldname>Date of 1st Reply</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>Thu, 19 Nov 2015 21:28:04 +0000</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10052" key="com.atlassian.jira.toolkit:dayslastcommented">
                        <customfieldname>Days since reply</customfieldname>
                        <customfieldvalues>
                                        8 years, 11 weeks ago
    
                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_18254" key="com.onresolve.jira.groovy.groovyrunner:scripted-field">
                        <customfieldname>Dependencies</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue><![CDATA[<s><a href='https://jira.mongodb.org/browse/WT-2224'>WT-2224</a></s>]]></customfieldvalue>


                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_15850" key="com.atlassian.jira.plugins.jira-development-integration-plugin:devsummary">
                        <customfieldname>Development</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    <customfield id="customfield_10057" key="com.atlassian.jira.toolkit:lastusercommented">
                        <customfieldname>Last comment by Customer</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>true</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                            <customfield id="customfield_10056" key="com.atlassian.jira.toolkit:lastupdaterorcommenter">
                        <customfieldname>Last commenter</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>alexander.gorrod@mongodb.com</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_11151" key="com.atlassian.jira.toolkit:LastCommentDate">
                        <customfieldname>Last public comment date</customfieldname>
                        <customfieldvalues>
                            8 years, 11 weeks ago
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                    <customfield id="customfield_10032" key="com.atlassian.jira.plugin.system.customfieldtypes:select">
                        <customfieldname>Operating System</customfieldname>
                        <customfieldvalues>
                                <customfieldvalue key="10026"><![CDATA[ALL]]></customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                <customfield id="customfield_10051" key="com.atlassian.jira.toolkit:participants">
                        <customfieldname>Participants</customfieldname>
                        <customfieldvalues>
                                        <customfieldvalue>dan@mongodb.com</customfieldvalue>
            <customfieldvalue>xgen-internal-githook</customfieldvalue>
            <customfieldvalue>michael.cahill@mongodb.com</customfieldvalue>
            <customfieldvalue>michael.grundy</customfieldvalue>
    
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                        <customfield id="customfield_14254" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Product Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>1|hrko73:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                <customfield id="customfield_12550" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>Rank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>2|hseitb:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                <customfield id="customfield_10558" key="com.pyxis.greenhopper.jira:gh-global-rank">
                        <customfieldname>Rank (Obsolete)</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>9223372036854775807</customfieldvalue>
                        </customfieldvalues>
                    </customfield>
                                                                                            <customfield id="customfield_23361" key="com.onresolve.jira.groovy.groovyrunner:scripted-field">
                        <customfieldname>Requested By</customfieldname>
                        <customfieldvalues>
                                

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                            <customfield id="customfield_10750" key="com.atlassian.jira.plugin.system.customfieldtypes:textarea">
                        <customfieldname>Steps To Reproduce</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>&lt;p&gt;Apply the attached patch that contains the election_timing_workload test and associated framework changes.&lt;/p&gt;

&lt;p&gt;run:&lt;/p&gt;
&lt;p/&gt;
&lt;div id=&quot;syntaxplugin&quot; class=&quot;syntaxplugin&quot; style=&quot;border: 1px dashed #bbb; border-radius: 5px !important; overflow: auto; max-height: 30em;&quot;&gt;
&lt;table cellspacing=&quot;0&quot; cellpadding=&quot;0&quot; border=&quot;0&quot; width=&quot;100%&quot; style=&quot;font-size: 1em; line-height: 1.4em !important; font-weight: normal; font-style: normal; color: black;&quot;&gt;
		&lt;tbody &gt;
				&lt;tr id=&quot;syntaxplugin_code_and_gutter&quot;&gt;
						&lt;td  style=&quot; line-height: 1.4em !important; padding: 0em; vertical-align: top;&quot;&gt;
					&lt;pre style=&quot;font-size: 1em; margin: 0 10px;  margin-top: 10px;   margin-bottom: 10px;  width: auto; padding: 0;&quot;&gt;&lt;span style=&quot;color: black; font-family: &apos;Consolas&apos;, &apos;Bitstream Vera Sans Mono&apos;, &apos;Courier New&apos;, Courier, monospace !important;&quot;&gt;./mongo --nodb jstests/replsets/election_timing_workload.js&lt;/span&gt;&lt;/pre&gt;
			&lt;/td&gt;
		&lt;/tr&gt;
			&lt;/tbody&gt;
&lt;/table&gt;
&lt;/div&gt;
&lt;p/&gt;

</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                    <customfield id="customfield_10053" key="com.atlassian.jira.ext.charting:timeinstatus">
                        <customfieldname>Time In Status</customfieldname>
                        <customfieldvalues>
                            
                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        <customfield id="customfield_22870" key="com.onresolve.jira.groovy.groovyrunner:scripted-field">
                        <customfieldname>Triagers</customfieldname>
                        <customfieldvalues>
                                

                        </customfieldvalues>
                    </customfield>
                                                                                                                                                                                                                                                                                                                                                                                    <customfield id="customfield_14350" key="com.pyxis.greenhopper.jira:gh-lexo-rank">
                        <customfieldname>serverRank</customfieldname>
                        <customfieldvalues>
                            <customfieldvalue>1|hsffh3:</customfieldvalue>

                        </customfieldvalues>
                    </customfield>
                                    </customfields>
    </item>
</channel>
</rss>