Crash in matras_touch in snapshot_daemon.test

[mejedi]

(gdb) f 0
#0  matras_touch (m=0xa9b76e0, id=<optimized out>) at /home/buildslave/tarantool/src/lib/small/small/matras.c:411
411     void **extent2p = (void **) extent1p[n1];
(gdb) bt
#0  matras_touch (m=0xa9b76e0, id=<optimized out>) at /home/buildslave/tarantool/src/lib/small/small/matras.c:411
#1  0x00000000004901d8 in bps_tree_index_touch_block (id=0, tree=0xa9b76a0) at /home/buildslave/tarantool/src/lib/salad/bps_tree.h:1214
#2  bps_tree_index_insert_into_leaf (new_elem=0x7f7c838070, leaf_path_elem=<synthetic pointer>, tree=0xa9b76a0) at /home/buildslave/tarantool/src/lib/salad/bps_tree.h:2143
#3  bps_tree_index_process_insert_leaf (new_elem=0x7f7c838070, leaf_path_elem=<synthetic pointer>, tree=0xa9b76a0) at /home/buildslave/tarantool/src/lib/salad/bps_tree.h:3019
#4  bps_tree_index_insert (tree=tree@entry=0xa9b76a0, new_elem=new_elem@entry=0x7f7c838070, replaced=0x5df310 <lj_char_bits>, replaced@entry=0x7f838a0c78)
    at /home/buildslave/tarantool/src/lib/salad/bps_tree.h:4054
#5  0x000000000048f2f4 in MemtxTree::replace (this=0xa9b7680, old_tuple=0x0, new_tuple=0x7f7c838070, mode=(DUP_INSERT | DUP_REPLACE | unknown: 124))
    at /home/buildslave/tarantool/src/box/memtx_tree.cc:244
#6  0x000000000047a010 in memtx_replace_all_keys (txn=0x7f838c0040, space=0xa9b75a0, old_tuple=0x7f838c0040, new_tuple=0x7f7c838070, mode=(unknown: 2206862840))
    at /home/buildslave/tarantool/src/box/memtx_engine.cc:486
#7  0x0000000000479954 in MemtxSpace::executeReplace (this=0xa9b0070, txn=0x7f838c0040, space=0xa9b75a0, request=0x7f838a0d68) at /home/buildslave/tarantool/src/box/memtx_engine.cc:238
#8  0x0000000000455c28 in process_rw (result=0x7f838a0df8, request=0x7f838a0d68) at /home/buildslave/tarantool/src/box/box.cc:116
#9  box_process1 (request=0x7f838a0d68, request@entry=0x7f838a0d88, result=result@entry=0x7f838a0df8) at /home/buildslave/tarantool/src/box/box.cc:536
#10 0x00000000004561f4 in box_insert (space_id=space_id@entry=512, tuple=0x7f838c0038 "\221\002\002", tuple_end=0x7f838c003a "\002", result=0x7f838a0df8, result@entry=0x7f838a0e18)
    at /home/buildslave/tarantool/src/box/box.cc:576
#11 0x000000000046597c in lbox_insert (L=0x7f83eee7a8) at /home/buildslave/tarantool/src/box/lua/index.c:55
#12 0x000000000050ac64 in lj_BC_FUNCC () at buildvm_arm64.dasc:894
#13 0x00000000004f7f70 in lua_pcall (L=L@entry=0x7f83eee7a8, nargs=<optimized out>, nresults=nresults@entry=-1, errfunc=errfunc@entry=0) at lj_api.c:1055
#14 0x00000000004aae90 in box_lua_fiber_run (ap=...) at /home/buildslave/tarantool/src/lua/fiber.c:279

[rtsisyk]

Reproduced on x86.

[rtsisyk]

tarantool/small#2

I discussed with @alyapunov. This problem can be easily to reproduced even on x86_64 and may crash on production during box.snapshot(). Sad, but true. A fix is one liner. => 1.6.7 (master).

I don't wish to maintain multiple branches of libsmall, so I decided to upgrade 1.6.7 to the latest libsmall (nothing actually changed except renaming *_ex_cb() to _xc_cb()).

• Fix libsmall and update matras unit test
• Checkout branch Crash in matras_touch in snapshot_daemon.test #1185-matras-crash-master in this repo and update libsmall to the fixed version
• Push a test case for Tarantool to Crash in matras_touch in snapshot_daemon.test #1185-matras-crash-master
• Push branch to master