savepoints crash mserver5

[yzchang]

Describe the bug
Running two transactions with a release savepoint in each of them crashes mserver5 at:

0x00007ffff62d6ff5 in idx_destroy (i=0xdbdbdbdbdbdbdbdb)
    at /home/vagrant/shared/monetdb/mdb-src/Oct2020/sql/storage/store.c:185
185		if (--(i->base.refcnt) > 0)

To Reproduce
Run the following queries to get the crash:

start transaction;
create table savepointtest (id int, primary key(id));
savepoint name1;
insert into savepointtest values(1), (2), (3);
savepoint name2;
insert into savepointtest values(4), (5), (6);
insert into savepointtest values(7), (8), (9);
savepoint name3;
release savepoint name3;
select * from savepointtest;
commit;

start transaction;
create table savepointtest (id int, primary key(id));
savepoint name1;
insert into savepointtest values(1), (2), (3);
savepoint name2;
insert into savepointtest values(4), (5), (6);
insert into savepointtest values(7), (8), (9);
savepoint name3;
release savepoint name1;
select * from savepointtest;
commit;

Note that, if we release savepoint "name2" instead of "name3" in the first transaction, mserver5 doesn't crash.

Expected behavior
No crash. The second transaction should abort since the table savepointtest already exists.

Software versions

• MonetDB version number [v11.39.8 (hg id: 0a97056b6c89), also happens with Oct2020-SP1 but the behavior is different]
• OS and version: [e.g. Ubuntu 20.04.1]
• Mercurial source code

[yzchang]

gdb.txt
Full stack-trace of the crashed thread

[yzchang]

The crash can be triggered with much simpler queries and it's related to the use of setting savepoint not release savepoint.

The following queries trigger the aforementioned SIGSEGV in store.c:185:

start transaction;
create table savepointtest (id int, primary key(id));
savepoint name1;
insert into savepointtest values(1), (2), (3);
savepoint name2;
insert into savepointtest values(4), (5), (6);
insert into savepointtest values(7), (8), (9);
--savepoint name3;
select * from savepointtest;
commit;

The following queries trigger the assertion mserver5: /home/vagrant/shared/monetdb/mdb-src/Oct2020/sql/storage/store.c:3940: trans_init: Assertion istmp || !c->base.allocated' failed.(note the change in the use of savepointname3instead ofname2`):

start transaction;
create table savepointtest (id int, primary key(id));
savepoint name1;
insert into savepointtest values(1), (2), (3);
--savepoint name2;
insert into savepointtest values(4), (5), (6);
insert into savepointtest values(7), (8), (9);
savepoint name3;
select * from savepointtest;
commit;

[yzchang]

Tests added: sql/test/BugTracker-2020/Tests/savepoints_crash_mserver5_{1,2}.Bug-7021.sql

[yzchang]

Both the SIGSEGV and the assertion have been fixed by changeset 65bc955a71cd