vinyl: fix crash if index is dropped while read task is in progress
If a fiber waiting for a read task to complete is cancelled, it will leave the read iterator immediately, leaving the read task pending. If the index is dropped before the read task is complete, the task will attempt to dereference a deleted run upon completion: 0 0x560b4007dbbc in print_backtrace+9 1 0x560b3ff80a1d in _ZL12sig_fatal_cbiP9siginfo_tPv+1e7 2 0x7f52b09190c0 in __restore_rt+0 3 0x7f52af6ea30a in bzero+5a 4 0x560b3ffc7a99 in mempool_free+2a 5 0x560b3ffcaeb7 in vy_page_read_cb_free+47 6 0x560b400806a2 in cbus_call_done+3f 7 0x560b400805ea in cmsg_deliver+30 8 0x560b40080e4b in cbus_process+51 9 0x560b4003046b in _ZL10tx_prio_cbP7ev_loopP10ev_watcheri+2b 10 0x560b4023d86e in ev_invoke_pending+ca 11 0x560b4023e772 in ev_run+5a0 12 0x560b3ff822dc in main+5ed 13 0x7f52af6862b1 in __libc_start_main+f1 14 0x560b3ff801da in _start+2a 15 (nil) in +2a Fix this by elevating the run reference counter per each read task. Note, currently we use vy_run::refs not only as a reference counter, but also as a counter of slices created for the run - see how we compare it to vy_run::compacted_slice_count in vy_task_compact_complete(). This isn't going to work anymore, obviously. Now we need to count slices created per each run in a separate counter, vy_run::slice_count. Anyway, it was a rather dubious hack to abuse reference counter for counting slices and it's good to finally get rid of it.
Showing
- src/box/vy_run.c 8 additions, 1 deletionsrc/box/vy_run.c
- src/box/vy_run.h 5 additions, 2 deletionssrc/box/vy_run.h
- src/box/vy_scheduler.c 1 addition, 1 deletionsrc/box/vy_scheduler.c
- test/vinyl/errinj.result 18 additions, 0 deletionstest/vinyl/errinj.result
- test/vinyl/errinj.test.lua 7 additions, 0 deletionstest/vinyl/errinj.test.lua
Loading
Please register or sign in to comment