Crash if transaction is aborted by timeout while Vinyl is reading disk #11088
Description
Bug description
Tarantool crahses if a transaction is aborted by timeout while Vinyl is reading disk.
Tarantool version:
Tarantool 3.4.0-entrypoint-92-ga217b0f5d4cf
Target: Linux-x86_64-Debug
Build options: cmake . -DCMAKE_INSTALL_PREFIX=/home/vlad/src/tarantool/tarantool/build/debug/install -DENABLE_BACKTRACE=TRUE
Compiler: GNU-13.2.0
C_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/vlad/src/tarantool/tarantool=. -std=c11 -Wall -Wextra -Wno-gnu-alignof-expression -fno-gnu89-inline -Wno-cast-function-type -Werror -g -ggdb -O0
CXX_FLAGS: -fexceptions -funwind-tables -fasynchronous-unwind-tables -fno-common -msse2 -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong -fPIC -fmacro-prefix-map=/home/vlad/src/tarantool/tarantool=. -std=c++11 -Wall -Wextra -Wno-invalid-offsetof -Wno-gnu-alignof-expression -Wno-cast-function-type -Werror -g -ggdb -O0
Steps to reproduce
Run the following script with a debug build:
local fiber = require('fiber')
os.execute('rm -rf [0-9]*')
box.cfg{}
local s = box.schema.space.create('test', {engine = 'vinyl'})
s:create_index('primary')
s:replace({1})
box.snapshot()
-- Suspend disk read for 1 second.
box.error.injection.set('ERRINJ_VY_READ_PAGE_DELAY', true)
fiber.create(function()
fiber.sleep(2)
box.error.injection.set('ERRINJ_VY_READ_PAGE_DELAY', false)
end)
-- Transaction is aborted while reading disk.
box.begin{timeout = 0.1}
s:update({1}, {{'!', 2, 20}})
box.commit()Actual behavior
Tarantool crashes:
2025-02-04 17:02:54.379 [343642] main/104/test.lua error.cc:391 I> ERRINJ_VY_READ_PAGE_DELAY = true
2025-02-04 17:02:56.379 [343642] main/117/lua error.cc:391 I> ERRINJ_VY_READ_PAGE_DELAY = false
2025-02-04 17:02:56.380 [343642] main/104/test.lua vinyl.c:1492 W> 512/0: get([1]) => [1] took too long: 2.002 sec
Segmentation fault
code: SEGV_MAPERR
addr: 0x18
context: 0x644b0f894340
siginfo: 0x644b0f894470
rax 0x0 0
rbx 0x40d2d540 1087558976
rcx 0x0 0
rdx 0x16 22
rsi 0x7d2630880b60 137602976451424
rdi 0x7d2630c250c0 137602980270272
rsp 0x7d2630880a60 137602976451168
rbp 0x7d2630880a90 137602976451216
r8 0x0 0
r9 0x0 0
r10 0x644b0f8df130 110273546285360
r11 0x293 659
r12 0x0 0
r13 0x0 0
r14 0x40d2e0a0 1087561888
r15 0x644add2a0e53 110272700878419
rip 0x644add16ec0c 110272699624460
eflags 0x10216 66070
cs 0x33 51
gs 0x0 0
fs 0x0 0
cr2 0x18 24
err 0x4 4
oldmask 0x0 0
trapno 0xe 14
Current time: 1738677776
Please file a bug at https://github.com/tarantool/tarantool/issues
Attempting backtrace... Note: since the server has already crashed,
this may fail as well
#1 0x644add30f907 in crash_collect+256
#2 0x644add310343 in crash_signal_cb+100
#3 0x7d2633645320 in __sigaction+80
#4 0x644add16ec0c in txn_commit_stmt+95
#5 0x644add1831ea in box_process_rw+427
#6 0x644add190b02 in box_process1+462
#7 0x644add191946 in box_update+276
#8 0x644add2a10d9 in lbox_index_update+646
#9 0x644add37f567 in lj_BC_FUNCC+70
#10 0x644add38d0ab in lua_pcall+969
#11 0x644add2ead03 in luaT_call+45
#12 0x644add2dc1a9 in lua_main+283
#13 0x644add2dcdc3 in run_script_f+3073
#14 0x644add03217c in fiber_cxx_invoke(int (*)(__va_list_tag*), __va_list_tag*)+34
#15 0x644add31c3fe in fiber_loop+219
#16 0x644add74d4e9 in coro_init+120
Aborted
Expected behavior
No crash. Instead TRANSACTION_CONFLICT error is raised.