memtx: fix heap-use-after-free of tuple stories caused by space alter
When a space is altered, we abort all in-progress transactions and delete all stories related to that space: the problem is we don't delete the stories' read gaps, which are also linked to the stories' transactions, which get cleaned up on transaction destruction — this, in turn, results in heap-use-after-free. To fix this, clean up stories' read gap in `memtx_on_space_delete` — we don't do this in `memtx_tx_story_delete` since it expects the story to not have any read gaps (see `memtx_tx_story_gc_step`). Tested this patch manually against Nick Shirokovskiy's experimental small-ASAN integration branch. Closes #8781 NO_DOC=bugfix NO_TEST=<already covered by existing tests, but was not detectable by ASAN>
Loading