Import wiredtiger: 5a3c70d7e4990685eedf765f6909bbbf4f824d5c from branch mongodb-4.4

ref: 25c305c94d..5a3c70d7e4
for: 4.5.1

WT-6281       Salvage/Verify should not assert or panic in the case of corrupted page cells
WT-6292       Fix the inconsistent prepare metadata value in checkpoint
WT-6293       Fix memory leak caused during unpacking an on-page disk

5 files changed, 40 insertions, 43 deletions

diff --git a/src/third_party/wiredtiger/import.data b/src/third_party/wiredtiger/import.data
index 75d0caac8d8..62a34a3cad1 100644
--- a/src/third_party/wiredtiger/import.data
+++ b/src/third_party/wiredtiger/import.data
@@ -2,5 +2,5 @@
     "vendor": "wiredtiger",
     "github": "wiredtiger/wiredtiger.git",
     "branch": "mongodb-4.4",
-    "commit": "25c305c94d2ba492841a7c2a270d9a92ea1fb284"
+    "commit": "5a3c70d7e4990685eedf765f6909bbbf4f824d5c"
 }
diff --git a/src/third_party/wiredtiger/src/btree/bt_page.c b/src/third_party/wiredtiger/src/btree/bt_page.c
index 08caa331b01..c6b2ebbe241 100644
--- a/src/third_party/wiredtiger/src/btree/bt_page.c
+++ b/src/third_party/wiredtiger/src/btree/bt_page.c
@@ -532,8 +532,8 @@ __inmem_row_leaf(WT_SESSION_IMPL *session, WT_PAGE *page)
 {
     WT_BTREE *btree;
     WT_CELL_UNPACK_KV unpack;
+    WT_DECL_ITEM(value);
     WT_DECL_RET;
-    WT_ITEM buf;
     WT_ROW *rip;
     WT_UPDATE *tombstone, **upd_array, *upd;
     size_t size, total_size;
@@ -543,7 +543,6 @@ __inmem_row_leaf(WT_SESSION_IMPL *session, WT_PAGE *page)
     btree = S2BT(session);
     tombstone = upd = NULL;
     prepare = false;
-    WT_CLEAR(buf);
 
     instantiate_prepared = F_ISSET(session, WT_SESSION_INSTANTIATE_PREPARE);
 
@@ -610,9 +609,11 @@ __inmem_row_leaf(WT_SESSION_IMPL *session, WT_PAGE *page)
             __wt_row_leaf_value_cell(session, page, rip, NULL, &unpack);
             if (unpack.tw.prepare) {
                 /* Take the value from the original page cell. */
-                WT_RET(__wt_page_cell_data_ref(session, page, &unpack, &buf));
+                if (value == NULL)
+                    WT_ERR(__wt_scr_alloc(session, 0, &value));
+                WT_ERR(__wt_page_cell_data_ref(session, page, &unpack, value));
 
-                WT_RET(__wt_upd_alloc(session, &buf, WT_UPDATE_STANDARD, &upd, &size));
+                WT_ERR(__wt_upd_alloc(session, value, WT_UPDATE_STANDARD, &upd, &size));
                 upd->durable_ts = unpack.tw.durable_start_ts;
                 upd->start_ts = unpack.tw.start_ts;
                 upd->txnid = unpack.tw.start_txn;
@@ -638,6 +639,7 @@ __inmem_row_leaf(WT_SESSION_IMPL *session, WT_PAGE *page)
                 }
 
                 upd_array[WT_ROW_SLOT(page, rip)] = tombstone;
+                tombstone = upd = NULL;
                 total_size += size;
             }
         }
@@ -645,10 +647,10 @@ __inmem_row_leaf(WT_SESSION_IMPL *session, WT_PAGE *page)
         __wt_cache_page_inmem_incr(session, page, total_size);
     }
 
-    if (0) {
 err:
-        __wt_free(session, upd);
-    }
+    __wt_free(session, tombstone);
+    __wt_free(session, upd);
+    __wt_scr_free(session, &value);
 
     return (ret);
 }
diff --git a/src/third_party/wiredtiger/src/include/cell.i b/src/third_party/wiredtiger/src/include/cell.i
index bac62081d35..6423566542b 100644
--- a/src/third_party/wiredtiger/src/include/cell.i
+++ b/src/third_party/wiredtiger/src/include/cell.i
@@ -10,18 +10,21 @@
  * __cell_check_value_validity --
  *     Check the value's validity window for sanity.
  */
-static inline void
-__cell_check_value_validity(WT_SESSION_IMPL *session, WT_TIME_WINDOW *tw)
+static inline int
+__cell_check_value_validity(WT_SESSION_IMPL *session, WT_TIME_WINDOW *tw, bool expected_error)
 {
 #ifdef HAVE_DIAGNOSTIC
     WT_DECL_RET;
 
     if ((ret = __wt_time_value_validate(session, tw, NULL, false)) != 0)
-        WT_IGNORE_RET(__wt_panic(session, ret, "value timestamp window failed validation"));
+        return (expected_error ? WT_ERROR : __wt_panic(session, ret,
+                                              "value timestamp window failed validation"));
 #else
     WT_UNUSED(session);
     WT_UNUSED(tw);
+    WT_UNUSED(expected_error);
 #endif
+    return (0);
 }
 
 /*
@@ -40,7 +43,7 @@ __cell_pack_value_validity(
         return;
     }
 
-    __cell_check_value_validity(session, tw);
+    WT_IGNORE_RET(__cell_check_value_validity(session, tw, false));
 
     **pp |= WT_CELL_SECOND_DESC;
     ++*pp;
@@ -98,18 +101,21 @@ __cell_pack_value_validity(
  * __wt_check_addr_validity --
  *     Check the address' validity window for sanity.
  */
-static inline void
-__wt_check_addr_validity(WT_SESSION_IMPL *session, WT_TIME_AGGREGATE *ta)
+static inline int
+__wt_check_addr_validity(WT_SESSION_IMPL *session, WT_TIME_AGGREGATE *ta, bool expected_error)
 {
 #ifdef HAVE_DIAGNOSTIC
     WT_DECL_RET;
 
     if ((ret = __wt_time_aggregate_validate(session, ta, NULL, false)) != 0)
-        WT_IGNORE_RET(__wt_panic(session, ret, "illegal address timestamp window"));
+        return (expected_error ? WT_ERROR : __wt_panic(session, ret,
+                                              "address timestamp window failed validation"));
 #else
     WT_UNUSED(session);
     WT_UNUSED(ta);
+    WT_UNUSED(expected_error);
 #endif
+    return (0);
 }
 
 /*
@@ -127,7 +133,7 @@ __cell_pack_addr_validity(WT_SESSION_IMPL *session, uint8_t **pp, WT_TIME_AGGREG
         return;
     }
 
-    __wt_check_addr_validity(session, ta);
+    WT_IGNORE_RET(__wt_check_addr_validity(session, ta, false));
 
     **pp |= WT_CELL_SECOND_DESC;
     ++*pp;
@@ -762,13 +768,9 @@ copy_cell_restart:
     case WT_CELL_ADDR_INT:
     case WT_CELL_ADDR_LEAF:
     case WT_CELL_ADDR_LEAF_NO:
-        /*
-         * Skip if we know we're not unpacking a cell of this type. This is all inlined code, and
-         * ideally checking allows the compiler to discard big chunks of it.
-         */
-        WT_ASSERT(session, unpack_value == NULL);
-        if (unpack_value != NULL)
-            break;
+        /* Return an error if we're not unpacking a cell of this type. */
+        if (unpack_addr == NULL)
+            return (WT_ERROR);
 
         if ((cell->__chunk[0] & WT_CELL_SECOND_DESC) == 0)
             break;
@@ -803,20 +805,16 @@ copy_cell_restart:
               &p, end == NULL ? 0 : WT_PTRDIFF(end, p), &ta->newest_stop_durable_ts));
             ta->newest_stop_durable_ts += ta->newest_stop_ts;
         }
-        __wt_check_addr_validity(session, ta);
+        WT_RET(__wt_check_addr_validity(session, ta, end != NULL));
         break;
     case WT_CELL_DEL:
     case WT_CELL_VALUE:
     case WT_CELL_VALUE_COPY:
     case WT_CELL_VALUE_OVFL:
     case WT_CELL_VALUE_OVFL_RM:
-        /*
-         * Skip if we know we're not unpacking a cell of this type. This is all inlined code, and
-         * ideally checking allows the compiler to discard big chunks of it.
-         */
-        WT_ASSERT(session, unpack_addr == NULL);
-        if (unpack_addr != NULL)
-            break;
+        /* Return an error if we're not unpacking a cell of this type. */
+        if (unpack_value == NULL)
+            return (WT_ERROR);
 
         if ((cell->__chunk[0] & WT_CELL_SECOND_DESC) == 0)
             break;
@@ -852,7 +850,7 @@ copy_cell_restart:
         else
             tw->durable_stop_ts = WT_TS_NONE;
 
-        __cell_check_value_validity(session, tw);
+        WT_RET(__cell_check_value_validity(session, tw, end != NULL));
         break;
     }
 
@@ -869,13 +867,9 @@ copy_cell_restart:
      */
     switch (unpack->raw) {
     case WT_CELL_VALUE_COPY:
-        /*
-         * Skip if we know we're not unpacking a cell of this type. This is all inlined code, and
-         * ideally checking allows the compiler to discard big chunks of it.
-         */
-        WT_ASSERT(session, unpack_addr == NULL);
-        if (unpack_addr != NULL)
-            break;
+        /* Return an error if we're not unpacking a cell of this type. */
+        if (unpack_value == NULL)
+            return (WT_ERROR);
 
         copy_cell = true;
 
diff --git a/src/third_party/wiredtiger/src/include/extern.h b/src/third_party/wiredtiger/src/include/extern.h
index 9042f73c20e..5a125934d91 100644
--- a/src/third_party/wiredtiger/src/include/extern.h
+++ b/src/third_party/wiredtiger/src/include/extern.h
@@ -1877,6 +1877,8 @@ static inline int __wt_cell_pack_value_match(WT_CELL *page_cell, WT_CELL *val_ce
 static inline int __wt_cell_unpack_safe(WT_SESSION_IMPL *session, const WT_PAGE_HEADER *dsk,
   WT_CELL *cell, WT_CELL_UNPACK_ADDR *unpack_addr, WT_CELL_UNPACK_KV *unpack_value, const void *end)
   WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result));
+static inline int __wt_check_addr_validity(WT_SESSION_IMPL *session, WT_TIME_AGGREGATE *ta,
+  bool expected_error) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result));
 static inline int __wt_col_append_serial(WT_SESSION_IMPL *session, WT_PAGE *page,
   WT_INSERT_HEAD *ins_head, WT_INSERT ***ins_stack, WT_INSERT **new_insp, size_t new_ins_size,
   uint64_t *recnop, u_int skipdepth, bool exclusive)
@@ -2150,7 +2152,6 @@ static inline void __wt_cell_unpack_addr(WT_SESSION_IMPL *session, const WT_PAGE
   WT_CELL *cell, WT_CELL_UNPACK_ADDR *unpack_addr);
 static inline void __wt_cell_unpack_kv(WT_SESSION_IMPL *session, const WT_PAGE_HEADER *dsk,
   WT_CELL *cell, WT_CELL_UNPACK_KV *unpack_value);
-static inline void __wt_check_addr_validity(WT_SESSION_IMPL *session, WT_TIME_AGGREGATE *ta);
 static inline void __wt_cond_wait(
   WT_SESSION_IMPL *session, WT_CONDVAR *cond, uint64_t usecs, bool (*run_func)(WT_SESSION_IMPL *));
 static inline void __wt_cursor_dhandle_decr_use(WT_SESSION_IMPL *session);
diff --git a/src/third_party/wiredtiger/src/meta/meta_ckpt.c b/src/third_party/wiredtiger/src/meta/meta_ckpt.c
index b80ca5659b1..c5b3c9d7924 100644
--- a/src/third_party/wiredtiger/src/meta/meta_ckpt.c
+++ b/src/third_party/wiredtiger/src/meta/meta_ckpt.c
@@ -693,7 +693,7 @@ __ckpt_load(WT_SESSION_IMPL *session, WT_CONFIG_ITEM *k, WT_CONFIG_ITEM *v, WT_C
     if (ret != WT_NOTFOUND && a.len != 0)
         ckpt->ta.prepare = (uint8_t)a.val;
 
-    __wt_check_addr_validity(session, &ckpt->ta);
+    WT_RET(__wt_check_addr_validity(session, &ckpt->ta, false));
 
     WT_RET(__wt_config_subgets(session, v, "write_gen", &a));
     if (a.len == 0)
@@ -779,7 +779,7 @@ __wt_meta_ckptlist_to_meta(WT_SESSION_IMPL *session, WT_CKPT *ckptbase, WT_ITEM
                 WT_RET(__wt_raw_to_hex(session, ckpt->raw.data, ckpt->raw.size, &ckpt->addr));
         }
 
-        __wt_check_addr_validity(session, &ckpt->ta);
+        WT_RET(__wt_check_addr_validity(session, &ckpt->ta, false));
 
         WT_RET(__wt_buf_catfmt(session, buf, "%s%s", sep, ckpt->name));
         sep = ",";
@@ -792,7 +792,7 @@ __wt_meta_ckptlist_to_meta(WT_SESSION_IMPL *session, WT_CKPT *ckptbase, WT_ITEM
           "=(addr=\"%.*s\",order=%" PRId64 ",time=%" PRIu64 ",size=%" PRId64
           ",newest_start_durable_ts=%" PRId64 ",oldest_start_ts=%" PRId64
           ",oldest_start_txn=%" PRId64 ",newest_stop_durable_ts=%" PRId64 ",newest_stop_ts=%" PRId64
-          ",newest_stop_txn=%" PRId64 ",prepare:%d,write_gen=%" PRId64 ")",
+          ",newest_stop_txn=%" PRId64 ",prepare=%d,write_gen=%" PRId64 ")",
           (int)ckpt->addr.size, (char *)ckpt->addr.data, ckpt->order, ckpt->sec,
           (int64_t)ckpt->size, (int64_t)ckpt->ta.newest_start_durable_ts,
           (int64_t)ckpt->ta.oldest_start_ts, (int64_t)ckpt->ta.oldest_start_txn,