(ITS#7623) P_SUBP page inn MDB dirty_list

[h.b.furuseth@usit.uio.no]

Full_Name: Hallvard B Furuseth
Version: RE24 + mdb.master 2d0b362b6f2b1247eb693008a39efaf341f15e82
OS: Linux x86_64
URL: 
Submission from: (NULL) (193.69.163.163)
Submitted by: hallvard


test043-delta-syncrepl crashes in RE24 + mdb.master + this patch.
A sub-cursor sees a regular (non-sub) page which has P_SUB set,
in dirty_list. The flag comes from the fake page in cursor_put.

Patch:
- Set P_FAKE flag for debugging, to see where the flag comes from.
- assert(not P_SUB) in page_get.
- valloc pages so we can see from the page address that it is
  a regular page.

--- libraries/liblmdb/mdb.c
+++ libraries/liblmdb/mdb.c
@@ -59,2 +59,3 @@
 #include <unistd.h>
+#include <malloc.h>
 
@@ -582,2 +583,3 @@ typedef struct MDB_page {
 #define	P_SUBP		 0x40		/**< for #MDB_DUPSORT sub-pages */
+#define P_FAKE		 0x80		/**< fake page */
 /** @} */
@@ -1271,3 +1273,3 @@ mdb_page_malloc(MDB_cursor *mc, unsigned num)
 	}
-	if ((ret = malloc(sz)) != NULL) {
+	if ((ret = valloc(sz)) != NULL) {
 		VGMEMP_ALLOC(env, ret, sz);
@@ -2478,2 +2480,3 @@ mdb_txn_commit(MDB_txn *txn)
 			dp = txn->mt_u.dirty_list[i].mptr;
+			assert(!(dp->mp_flags & P_SUBP));
 			if (dp->mp_pgno != next) {
@@ -4069,2 +4072,3 @@ mdb_page_get(MDB_txn *txn, pgno_t pgno, MDB_page **ret,
int *lvl)
 					p = dl[x].mptr;
+					/* assert(!(p->mp_flags & P_SUBP)); */
 					goto done;
@@ -5164,3 +5168,3 @@ more:
 				fp->mp_pgno = mc->mc_pg[mc->mc_top]->mp_pgno;
-				fp->mp_flags = P_LEAF|P_DIRTY|P_SUBP;
+				fp->mp_flags = P_LEAF|P_DIRTY|P_SUBP|P_FAKE;
 				fp->mp_lower = PAGEHDRSZ;

Backtrace:
#4  mdb_page_get (txn=0x7f7d70104970, pgno=36, ret=0x7f7d70106e30, lvl=0x0) at
./../../../libraries/liblmdb/mdb.c:4072
p = 0x7f7d70118000
*p = {mp_p.p_pgno = 0x24, mp_pad = 0x7000,
      mp_flags = P_LEAF|P_DIRTY|P_SUBP|P_FAKE,
      mp_pb.pb = {pb_lower = 0x3c, pb_upper = 0x87e}, ...}
#5  mdb_page_search (mc=0x7f7d70106de8, key=0x7f7d7b2fe6f0, flags=0) at
./../../../libraries/liblmdb/mdb.c:4264
#6  mdb_cursor_set (mc=0x7f7d70106de8, key=0x7f7d7b2fe6f0, data=0x7f7d7b2fbf80,
op=MDB_SET,  exactp=0x7f7d7b2fbf94) at ./../../../libraries/liblmdb/mdb.c:4690
#7  mdb_cursor_put (mc=0x7f7d70106de8, key=0x7f7d7b2fe6f0, data=0x7f7d7b2fe5a0,
flags=16) at ./../../../libraries/liblmdb/mdb.c:5107
#8  mdb_cursor_put (mc=0x7f7d70106c60, key=0x7f7d7b2fe700, data=0x7f7d7b2fe6f0,
flags=38) at ./../../../libraries/liblmdb/mdb.c:5413
#9  mdb_dn2id_add (op=0x7f7d7b2fec70, mcp=0x7f7d70106c60, mcd=0x7f7d70106c60,
pid=1, nsubs=1,  upsub=1, e=0x1109f98) at dn2id.c:141
#10 mdb_add (op=0x7f7d7b2fec70, rs=0x7f7d7b2fec00) at add.c:341
#11 overlay_op_walk (op=0x7f7d7b2fec70, rs=0x7f7d7b2fec00, which=op_add,
oi=0x10bff00, on=0x0) at backover.c:671
#12 over_op_func (op=0x7f7d7b2fec70, rs, which) at backover.c:723
#13 over_op_add (op, rs) at backover.c:774
#14 accesslog_response (op, rs) at accesslog.c:1835
#15 over_back_response (op=0x7f7d700008f0, rs=0x7f7d7b300920) at backover.c:237
#16 slap_response_play (op=0x7f7d700008f0, rs=0x7f7d7b300920) at result.c:491
#17 send_ldap_response (op=0x7f7d700008f0, rs=0x7f7d7b300920) at result.c:566
#18 slap_send_ldap_result (op=0x7f7d700008f0, rs=0x7f7d7b300920) at
result.c:844
#19 mdb_modify (op=0x7f7d700008f0, rs=0x7f7d7b300920) at modify.c:655
#20 overlay_op_walk (op=0x7f7d700008f0, rs=0x7f7d7b300920, which=op_modify,
oi=0x10c0d50, on=0x0) at backover.c:671
#21 over_op_func (op=0x7f7d700008f0, rs, which) at backover.c:723
#22 over_op_modify (op, rs) at backover.c:762
#23 fe_op_modify (op=0x7f7d700008f0, rs=0x7f7d7b300920) at modify.c:303
#24 do_modify (op=0x7f7d700008f0, rs=0x7f7d7b300920) at modify.c:177
#25 connection_operation (ctx=0x7f7d7b300a70, arg_v=0x7f7d700008f0) at
connection.c:1155
#26 connection_read_thread (ctx=0x7f7d7b300a70, argv) at connection.c:1291
#27 ldap_int_thread_pool_wrapper (xpool=0x106b320) at tpool.c:688