bug in handover

[finnschiermer]

Sometimes the handover verifier reports that two tableviews which should be identical are in fact different.

https://ci.realm.io/job/core_osx/1835/testReport/junit/%28root%29/DefaultSuite/LangBindHelper_HandoverBetweenThreads/

[finnschiermer]

Address sanitizer to the rescue:

test_lang_bind_helper.cpp:8233: Begin LangBindHelper_HandoverBetweenThreads

==11622==ERROR: AddressSanitizer: heap-use-after-free on address 0x606000002fd8 at pc 0x5d08e1 bp 0x2b097a231250 sp 0x2b097a231248
READ of size 8 at 0x606000002fd8 thread T1
#0 0x5d08e0 in realm::Descriptor::unbind_ref() const ../src/realm/descriptor.hpp:693
#1 0xa160c3 in realm::util::bind_ptr<realm::Descriptor const>::unbind() ../src/realm/util/bind_ptr.hpp:144
#2 0xa142bf in realm::util::bind_ptr<realm::Descriptor const>::~bind_ptr() ../src/realm/util/bind_ptr.hpp:62
#3 0x2b0976401c63 in realm::Query::~Query() /home/finn/tightdb/src/realm/query.cpp:154
#4 0x4a2529 in realm::TableViewBase::~TableViewBase() ../src/realm/table_view.hpp:814
#5 0x4a261b in realm::TableView::~TableView() ../src/realm/table_view.hpp:1114
#6 0x6fa722 in handover_querier /home/finn/tightdb/test/test_lang_bind_helper.cpp:8173
#7 0x714f68 in _call<void, 0ul, 1ul, 2ul> /usr/include/c++/4.9/functional:1264
#8 0x71419e in operator()<, void> /usr/include/c++/4.9/functional:1323
#9 0x70e93f in entry_point<std::Bind<void (*((anonymous namespace)::HandoverControl<realm::SharedGroup::Handoverrealm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string))((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string)> > ../src/realm/util/thread.hpp:356
#10 0x2b0976f41181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181)
#11 0x2b097725147c in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xfa47c)

0x606000002fd8 is located 24 bytes inside of 56-byte region [0x606000002fc0,0x606000002ff8)
freed by thread T2 here:
#0 0x2b0974fab517 in operator delete(void_) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x55517)
#1 0x5d0925 in realm::Descriptor::unbind_ref() const ../src/realm/descriptor.hpp:694
#2 0xa160c3 in realm::util::bind_ptr<realm::Descriptor const>::unbind() ../src/realm/util/bind_ptr.hpp:144
#3 0xa142bf in realm::util::bind_ptr<realm::Descriptor const>::~bind_ptr() ../src/realm/util/bind_ptr.hpp:62
#4 0x2b097640306a in realm::Query::fetch_descriptor() /home/finn/tightdb/src/realm/query.cpp:385
#5 0x2b09764029a4 in realm::Query::set_table(realm::BasicTableRefrealm::Table) /home/finn/tightdb/src/realm/query.cpp:225
#6 0x2b0976402bcc in realm::Query::apply_patch(realm::Query_Handover_patch&, realm::Group&) /home/finn/tightdb/src/realm/query.cpp:241
#7 0x2b097662b5c7 in realm::TableViewBase::apply_patch(realm::TableView_Handover_patch&, realm::Group&) /home/finn/tightdb/src/realm/table_view.cpp:93
#8 0x4a1f40 in realm::TableView::apply_patch(realm::TableView_Handover_patch&, realm::Group&) ../src/realm/table_view.hpp:557
#9 0x4a1e49 in realm::TableView::apply_and_consume_patch(std::unique_ptr<realm::TableView_Handover_patch, std::default_deleterealm::TableView_Handover_patch >&, realm::Group&) ../src/realm/table_view.hpp:538
#10 0x74c73b in std::unique_ptr<realm::TableView, std::default_deleterealm::TableView > realm::SharedGroup::import_from_handoverrealm::TableView(std::unique_ptrrealm::SharedGroup::Handover<realm::TableView, std::default_deleterealm::SharedGroup::Handover<realm::TableView > >) ../src/realm/group_shared.hpp:877
#11 0x6fadaf in handover_verifier /home/finn/tightdb/test/test_lang_bind_helper.cpp:8219
#12 0x714f68 in __call<void, 0ul, 1ul, 2ul> /usr/include/c++/4.9/functional:1264
#13 0x71419e in operator()<, void> /usr/include/c++/4.9/functional:1323
#14 0x70e93f in entry_point<std::Bind<void (((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string))((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string)> > ../src/realm/util/thread.hpp:356
#15 0x2b0976f41181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181)

previously allocated by thread T1 here:
#0 0x2b0974fab09f in operator new(unsigned long) (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x5509f)
#1 0x2b09765f727b in realm::impl::DescriptorFriend::create() ../realm/descriptor.hpp:735
#2 0x2b09765d9c19 in realm::Table::get_descriptor() /home/finn/tightdb/src/realm/table.cpp:439
#3 0x2b0976402ebd in realm::Query::fetch_descriptor() /home/finn/tightdb/src/realm/query.cpp:381
#4 0x2b097640094f in realm::Query::create() /home/finn/tightdb/src/realm/query.cpp:63
#5 0x2b09763ffcda in realm::Query::Query(realm::Table&, realm::TableViewBase) /home/finn/tightdb/src/realm/query.cpp:25
#6 0x61e57e in realm::Table::where(realm::TableViewBase_) ../src/realm/table.hpp:659
#7 0x6fa471 in handover_querier /home/finn/tightdb/test/test_lang_bind_helper.cpp:8173
#8 0x714f68 in _call<void, 0ul, 1ul, 2ul> /usr/include/c++/4.9/functional:1264
#9 0x71419e in operator()<, void> /usr/include/c++/4.9/functional:1323
#10 0x70e93f in entry_point<std::Bind<void (*((anonymous namespace)::HandoverControl<realm::SharedGroup::Handoverrealm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string))((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string)> > ../src/realm/util/thread.hpp:356
#11 0x2b0976f41181 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8181)

Thread T1 created by T0 here:
#0 0x2b0974f79c4a in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23c4a)
#1 0x5e37c5 in realm::util::Thread::start(void* ()(void), void_) ../../src/realm/util/thread.hpp:347
#2 0x7090c1 in start<std::Bind<void (((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string))((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string)> > ../src/realm/util/thread.hpp:328
#3 0x6fb825 in Realm_UnitTest__LangBindHelper_HandoverBetweenThreads::test_run() /home/finn/tightdb/test/test_lang_bind_helper.cpp:8249
#4 0xb5deac in realm::test_util::unit_test::TestList::ExecContext::run() /home/finn/tightdb/test/util/unit_test.cpp:314
#5 0xb5e955 in realm::test_util::unit_test::TestList::run(realm::test_util::unit_test::Reporter_, realm::test_util::unit_test::Filter_, int, bool) /home/finn/tightdb/test/util/unit_test.cpp:363
#6 0x499b24 in run_tests /home/finn/tightdb/test/test_all.cpp:340
#7 0x499eb6 in test_all(int, char**) /home/finn/tightdb/test/test_all.cpp:377
#8 0xb5a849 in main /home/finn/tightdb/test/main.cpp:5
#9 0x2b0977178ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)

Thread T2 created by T0 here:
#0 0x2b0974f79c4a in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.1+0x23c4a)
#1 0x5e37c5 in realm::util::Thread::start(void* ()(void), void_) ../../src/realm/util/thread.hpp:347
#2 0x7090c1 in start<std::Bind<void (((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string))((anonymous namespace)::HandoverControlrealm::SharedGroup::Handover<realm::TableView >, realm::test_util::unit_test::TestResults, std::basic_string)> > ../src/realm/util/thread.hpp:328
#3 0x6fb8ce in Realm_UnitTest__LangBindHelper_HandoverBetweenThreads::test_run() /home/finn/tightdb/test/test_lang_bind_helper.cpp:8250
#4 0xb5deac in realm::test_util::unit_test::TestList::ExecContext::run() /home/finn/tightdb/test/util/unit_test.cpp:314
#5 0xb5e955 in realm::test_util::unit_test::TestList::run(realm::test_util::unit_test::Reporter_, realm::test_util::unit_test::Filter_, int, bool) /home/finn/tightdb/test/util/unit_test.cpp:363
#6 0x499b24 in run_tests /home/finn/tightdb/test/test_all.cpp:340
#7 0x499eb6 in test_all(int, char**) /home/finn/tightdb/test/test_all.cpp:377
#8 0xb5a849 in main /home/finn/tightdb/test/main.cpp:5
#9 0x2b0977178ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)

SUMMARY: AddressSanitizer: heap-use-after-free ../src/realm/descriptor.hpp:693 realm::Descriptor::unbind_ref() const

[finnschiermer]

fixed by #1109