locker
commented
4 months ago Short reproducer:
local fiber = require('fiber')
box.cfg{}
local s = box.schema.create_space('test', {engine = 'vinyl'})
s:create_index('pk')
s:create_index('sk', {parts = {2, 'unsigned'}})
s:insert{1, 10}
box.snapshot()
box.error.injection.set('ERRINJ_VY_READ_PAGE_DELAY', true)
fiber.create(function()
s:insert{2, 10}
end)
s.index.sk:drop()
box.error.injection.set('ERRINJ_VY_READ_PAGE_DELAY', false)
os.exit(0)The crash occurs because the index is dropped while another fiber is reading from it. As a result, vy_lsm_delete yields while waiting for the reader to finish, which results in a crash in the alter_space_commit trigger, where yields aren't allowed.
To fix this issue we need to take a reference to the index before yielding on disk. Also, we need to replace vy_slice_wait_pinned(slice) in vy_range_tree_fee_cb with assert(slice->pin_count == 0), because vy_lsm_delete must not yield:
We already fixed a similar issue, see 75f03a50df4a7.
Bug description
Tarantool 3.2.0-entrypoint-56-g05d03a1c58 Target: Linux-x86_64-Debug Build options: cmake . -DCMAKE_INSTALL_PREFIX=/usr/local -DENABLE_BACKTRACE=TRUE Compiler: GNU-11.4.0 C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -Werror -g -ggdb -O0 CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/sergeyb/sources/MRG/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
Steps to reproduce
Actually, there are no exact steps to reproduce.
Actual behavior
coredump + tarantool binary: gh-10094-core.zip
Backtrace:
Expected behavior
no crash