WT-3373 Access violation due to a bug in internal page splitting (#3478)mongodb-3.2.16mongodb-3.2.15

When acquiring a lock on our parent internal page, we use the WT_REF.home
field to reference our parent page.  As a child of the parent page, we
prevent its eviction, but that's a weak guarantee. If the parent page
splits, and our WT_REF were to move with the split, the WT_REF.home field
might change underneath us and we could race, and end up attempting to
access an evicted page. Set the session page-index generation so if the
parent splits, it still can't be evicted.

1 files changed, 29 insertions, 3 deletions

diff --git a/src/btree/bt_split.c b/src/btree/bt_split.c
index 627e6b9cb48..92be2125b88 100644
--- a/src/btree/bt_split.c
+++ b/src/btree/bt_split.c
@@ -1256,12 +1256,12 @@ err:	switch (complete) {
 }
 
 /*
- * __split_internal_lock --
+ * __split_internal_lock_worker --
  *	Lock an internal page.
  */
 static int
-__split_internal_lock(WT_SESSION_IMPL *session, WT_REF *ref, bool trylock,
-    WT_PAGE **parentp, bool *hazardp)
+__split_internal_lock_worker(WT_SESSION_IMPL *session,
+    WT_REF *ref, bool trylock, WT_PAGE **parentp, bool *hazardp)
 {
 	WT_DECL_RET;
 	WT_PAGE *parent;
@@ -1340,6 +1340,32 @@ err:	WT_PAGE_UNLOCK(session, parent);
 }
 
 /*
+ * __split_internal_lock --
+ *	Lock an internal page.
+ */
+static int
+__split_internal_lock(WT_SESSION_IMPL *session,
+    WT_REF *ref, bool trylock, WT_PAGE **parentp, bool *hazardp)
+{
+	WT_DECL_RET;
+
+	/*
+	 * There's no lock on our parent page and we're about to acquire one,
+	 * which implies using the WT_REF.home field to reference our parent
+	 * page. As a child of the parent page, we prevent its eviction, but
+	 * that's a weak guarantee. If the parent page splits, and our WT_REF
+	 * were to move with the split, the WT_REF.home field might change
+	 * underneath us and we could race, and end up attempting to access
+	 * an evicted page. Set the session page-index generation so if the
+	 * parent splits, it still can't be evicted.
+	 */
+	WT_WITH_PAGE_INDEX(session,
+	    ret = __split_internal_lock_worker(
+	    session, ref, trylock, parentp, hazardp));
+	return (ret);
+}
+
+/*
  * __split_internal_unlock --
  *	Unlock the parent page.
  */