tarantool / tarantool / 8608

86%

master: 87%

push

travis-ci

vinyl: fix use-after-free of last_stmt in vy_run_write_page

vy_run_write_page() doesn't take a reference to last_stmt, because it
assumes that the write iterator guarantees it won't be deleted until
'next' is called again. The iterator does pin a statement if it is read
from a run file - see vy_write_iterator_set_tuple() - however there's a
case when the last returned statement can go away under us. This will
happen if the iterator is used for major compaction and the last source
statement is a DELETE. In this case the iterator will unreference the
last statement it returned to the caller, take a reference to the DELETE
instead, but won't return the DELETE - see vy_write_iterator_next(). As
a result, the caller, i.e. vy_run_write_page(), will hit use-after-free
on an attempt to read last_stmt.

To fix this bug, let's make vy_run_write_page() take a reference to
last_stmt as it used to before the write iterator was reworked. A test
case will be added later, after all iterator-related issues have been
fixed.

Closes #2578

12 of 12 new or added lines in 1 file covered. (100.0%)

29694 of 34412 relevant lines covered (86.29%)

1062747.11 hits per line