Import wiredtiger: 1f5b2ca8f2903ebed5db2880206d68129df948a2 from branch mongodb-master

ref: 55e953e187..1f5b2ca8f2
for: 6.3.0-rc0

WT-10190 Fix null deference in __wt_cell_unpack_safe and disable packing with feature flag

7 files changed, 31 insertions, 16 deletions

diff --git a/src/third_party/wiredtiger/import.data b/src/third_party/wiredtiger/import.data
index 7d4453a7bf5..7f1b84bb234 100644
--- a/src/third_party/wiredtiger/import.data
+++ b/src/third_party/wiredtiger/import.data
@@ -2,5 +2,5 @@
     "vendor": "wiredtiger",
     "github": "wiredtiger/wiredtiger.git",
     "branch": "mongodb-master",
-    "commit": "55e953e187acabfc120123ccc4d619c0777da01a"
+    "commit": "1f5b2ca8f2903ebed5db2880206d68129df948a2"
 }
diff --git a/src/third_party/wiredtiger/src/btree/bt_split.c b/src/third_party/wiredtiger/src/btree/bt_split.c
index 44ade7c1883..a00a66440f7 100644
--- a/src/third_party/wiredtiger/src/btree/bt_split.c
+++ b/src/third_party/wiredtiger/src/btree/bt_split.c
@@ -245,6 +245,7 @@ __split_ref_move(WT_SESSION_IMPL *session, WT_PAGE *from_home, WT_REF **from_ref
     if (ref_addr != NULL && !__wt_off_page(from_home, ref_addr)) {
         __wt_cell_unpack_addr(session, from_home->dsk, (WT_CELL *)ref_addr, &unpack);
         WT_RET(__wt_calloc_one(session, &addr));
+        WT_PAGE_STAT_COPY(&addr->ps, &unpack.ps);
         WT_TIME_AGGREGATE_COPY(&addr->ta, &unpack.ta);
         WT_ERR(__wt_memdup(session, unpack.data, unpack.size, &addr->addr));
         addr->size = (uint8_t)unpack.size;
@@ -1731,6 +1732,7 @@ __wt_multi_to_ref(WT_SESSION_IMPL *session, WT_PAGE *page, WT_MULTI *multi, WT_R
     if (multi->addr.addr != NULL) {
         WT_RET(__wt_calloc_one(session, &addr));
         ref->addr = addr;
+        WT_PAGE_STAT_COPY(&addr->ps, &multi->addr.ps);
         WT_TIME_AGGREGATE_COPY(&addr->ta, &multi->addr.ta);
         WT_RET(__wt_memdup(session, multi->addr.addr, multi->addr.size, &addr->addr));
         addr->size = multi->addr.size;
diff --git a/src/third_party/wiredtiger/src/btree/bt_vrfy_dsk.c b/src/third_party/wiredtiger/src/btree/bt_vrfy_dsk.c
index 8bf4f55c65b..5a9a1127b69 100644
--- a/src/third_party/wiredtiger/src/btree/bt_vrfy_dsk.c
+++ b/src/third_party/wiredtiger/src/btree/bt_vrfy_dsk.c
@@ -136,8 +136,10 @@ __wt_verify_dsk_image(WT_SESSION_IMPL *session, const char *tag, const WT_PAGE_H
         LF_CLR(WT_PAGE_UNUSED);
     if (LF_ISSET(WT_PAGE_FT_UPDATE))
         LF_CLR(WT_PAGE_FT_UPDATE);
-    if (LF_ISSET(WT_PAGE_STAT_ROWBYTE))
-        LF_CLR(WT_PAGE_STAT_ROWBYTE);
+    if (LF_ISSET(WT_PAGE_STAT_BYTE_COUNT))
+        LF_CLR(WT_PAGE_STAT_BYTE_COUNT);
+    if (LF_ISSET(WT_PAGE_STAT_ROW_COUNT))
+        LF_CLR(WT_PAGE_STAT_ROW_COUNT);
     if (flags != 0)
         WT_RET_VRFY(session, "page at %s has invalid flags set: 0x%" PRIx8, tag, flags);
 
diff --git a/src/third_party/wiredtiger/src/include/btmem.h b/src/third_party/wiredtiger/src/include/btmem.h
index 5a41d147761..68b7ab8f245 100644
--- a/src/third_party/wiredtiger/src/include/btmem.h
+++ b/src/third_party/wiredtiger/src/include/btmem.h
@@ -72,14 +72,15 @@ struct __wt_page_header {
 /*
  * No automatic generation: flag values cannot change, they're written to disk.
  */
-#define WT_PAGE_COMPRESSED 0x01u   /* Page is compressed on disk */
-#define WT_PAGE_EMPTY_V_ALL 0x02u  /* Page has all zero-length values */
-#define WT_PAGE_EMPTY_V_NONE 0x04u /* Page has no zero-length values */
-#define WT_PAGE_ENCRYPTED 0x08u    /* Page is encrypted on disk */
-#define WT_PAGE_UNUSED 0x10u       /* Historic lookaside store page updates, no longer used */
-#define WT_PAGE_FT_UPDATE 0x20u    /* Page contains updated fast-truncate information */
-#define WT_PAGE_STAT_ROWBYTE 0x40u /* Page contains row and byte counts */
-    uint8_t flags;                 /* 25: flags */
+#define WT_PAGE_COMPRESSED 0x01u      /* Page is compressed on disk */
+#define WT_PAGE_EMPTY_V_ALL 0x02u     /* Page has all zero-length values */
+#define WT_PAGE_EMPTY_V_NONE 0x04u    /* Page has no zero-length values */
+#define WT_PAGE_ENCRYPTED 0x08u       /* Page is encrypted on disk */
+#define WT_PAGE_UNUSED 0x10u          /* Historic lookaside store page updates, no longer used */
+#define WT_PAGE_FT_UPDATE 0x20u       /* Page contains updated fast-truncate information */
+#define WT_PAGE_STAT_BYTE_COUNT 0x40u /* Page contains byte count information */
+#define WT_PAGE_STAT_ROW_COUNT 0x80u  /* Page contains row count information */
+    uint8_t flags;                    /* 25: flags */
 
     /* A byte of padding, positioned to be added to the flags. */
     uint8_t unused; /* 26: unused padding */
diff --git a/src/third_party/wiredtiger/src/include/cell_inline.h b/src/third_party/wiredtiger/src/include/cell_inline.h
index 3edb3ad422a..9ae1e8b402d 100644
--- a/src/third_party/wiredtiger/src/include/cell_inline.h
+++ b/src/third_party/wiredtiger/src/include/cell_inline.h
@@ -935,10 +935,10 @@ copy_cell_restart:
     case WT_CELL_ADDR_LEAF:
     case WT_CELL_ADDR_LEAF_NO:
         /* Unpack the row and/or byte counts if the chunk of data includes it. */
-        if (F_ISSET(dsk, WT_PAGE_STAT_ROWBYTE)) {
-            if (WT_PAGE_STAT_HAS_BYTE_COUNT(&unpack_addr->ps))
+        if (ps != NULL && __wt_process.page_stats_2022) {
+            if (F_ISSET(dsk, WT_PAGE_STAT_BYTE_COUNT))
                 WT_RET(__wt_vunpack_int(&p, end == NULL ? 0 : WT_PTRDIFF(end, p), &ps->byte_count));
-            if (WT_PAGE_STAT_HAS_ROW_COUNT(&unpack_addr->ps))
+            if (F_ISSET(dsk, WT_PAGE_STAT_ROW_COUNT))
                 WT_RET(__wt_vunpack_int(&p, end == NULL ? 0 : WT_PTRDIFF(end, p), &ps->row_count));
         }
         /* FALLTHROUGH */
diff --git a/src/third_party/wiredtiger/src/include/reconcile.h b/src/third_party/wiredtiger/src/include/reconcile.h
index b644419c6de..cfac0ef45f2 100644
--- a/src/third_party/wiredtiger/src/include/reconcile.h
+++ b/src/third_party/wiredtiger/src/include/reconcile.h
@@ -62,6 +62,8 @@ struct __wt_rec_chunk {
     /* For fixed-length column store, track where the time windows start and how many we have. */
     uint32_t aux_start_offset;
     uint32_t auxentries;
+
+    WT_PAGE_STAT ps;
 };
 
 /*
@@ -322,6 +324,8 @@ struct __wt_reconcile {
      */
     bool hs_clear_on_tombstone;
     WT_CURSOR *hs_cursor;
+
+    WT_PAGE_STAT ps;
 };
 
 typedef struct {
diff --git a/src/third_party/wiredtiger/src/reconcile/rec_write.c b/src/third_party/wiredtiger/src/reconcile/rec_write.c
index 8746dae1308..7474dbdc925 100644
--- a/src/third_party/wiredtiger/src/reconcile/rec_write.c
+++ b/src/third_party/wiredtiger/src/reconcile/rec_write.c
@@ -968,6 +968,7 @@ __rec_split_chunk_init(WT_SESSION_IMPL *session, WT_RECONCILE *r, WT_REC_CHUNK *
     /* Don't touch the key item memory, that memory is reused. */
     chunk->key.size = 0;
     chunk->entries = 0;
+    WT_PAGE_STAT_INIT(&chunk->ps);
     WT_TIME_AGGREGATE_INIT_MERGE(&chunk->ta);
 
     chunk->min_recno = WT_RECNO_OOB;
@@ -1886,8 +1887,11 @@ __rec_split_write_header(WT_SESSION_IMPL *session, WT_RECONCILE *r, WT_REC_CHUNK
         F_SET(dsk, WT_PAGE_FT_UPDATE);
 
     /* Set the page stat cell information flag. */
-    if (__wt_process.page_stats_2022)
-        F_SET(dsk, WT_PAGE_STAT_ROWBYTE);
+    if (WT_PAGE_STAT_HAS_BYTE_COUNT(&chunk->ps))
+        F_SET(dsk, WT_PAGE_STAT_BYTE_COUNT);
+
+    if (WT_PAGE_STAT_HAS_ROW_COUNT(&chunk->ps))
+        F_SET(dsk, WT_PAGE_STAT_ROW_COUNT);
 
     dsk->unused = 0;
     dsk->version = WT_PAGE_VERSION_TS;
@@ -2080,6 +2084,8 @@ __rec_split_write(WT_SESSION_IMPL *session, WT_RECONCILE *r, WT_REC_CHUNK *chunk
     WT_RET(__wt_realloc_def(session, &r->multi_allocated, r->multi_next + 1, &r->multi));
     multi = &r->multi[r->multi_next++];
 
+    WT_PAGE_STAT_COPY(&multi->addr.ps, &chunk->ps);
+
     /* Initialize the address (set the addr type for the parent). */
     WT_TIME_AGGREGATE_COPY(&multi->addr.ta, &chunk->ta);