crash in dense set defragmentation

[romange]

See below:

#3  0x00007ffff7c4526e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4  0x00005555561da46e in absl::lts_20240116::AbslFailureSignalHandler(int, siginfo_t*, void*) ()
#5  <signal handler called>
#6  0x0000555555b362c3 in mi_slice_first (slice=0x65e19793ae006108) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:471
#7  _mi_segment_page_of (p=0x65e19793af000000, segment=<optimized out>) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:486
#8  _mi_ptr_page (p=0x65e19793af000000) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:502
#9  mi_heap_page_is_underutilized (heap=0x339c2110800, p=p@entry=0x65e19793af000000, ratio=0, ratio@entry=0.800000012) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/src/alloc.c:581
#10 0x0000555555b33906 in zmalloc_page_is_underutilized (ptr=ptr@entry=0x65e19793af000000, ratio=ratio@entry=0.800000012) at ../src/redis/zmalloc_mi.c:179
#11 0x0000555555a6192a in dfly::StringMap::ReallocIfNeeded (this=<optimized out>, obj=0x339c27d1a03, ratio=0.800000012) at ../src/core/string_map.cc:198
#12 0x0000555555a61b02 in <lambda(auto:25*)>::operator()<dfly::DenseSet::DensePtr> (ptr=0x339c2188640, __closure=0x339f234d7c0) at ../src/core/string_map.cc:304
#13 std::_Function_handler<void(dfly::DenseSet::DensePtr*), dfly::StringMap::iterator::ReallocIfNeeded(float)::<lambda(auto:25*)> >::_M_invoke(const std::_Any_data &, dfly::DenseSet::DensePtr *&&) (__functor=...,
    __args#0=<optimized out>) at /usr/include/c++/9/bits/std_function.h:300
#14 0x0000555555a47970 in std::function<void (dfly::DenseSet::DensePtr*)>::operator()(dfly::DenseSet::DensePtr*) const (__args#0=<optimized out>, this=0x7fffe8007f50) at /usr/include/c++/9/bits/std_function.h:688
#15 dfly::DenseSet::IteratorBase::TraverseApply(dfly::DenseSet::DensePtr*, std::function<void (dfly::DenseSet::DensePtr*)>) (this=this@entry=0x7fffe8007fb0, ptr=<optimized out>, fun=...) at ../src/core/dense_set.cc:855
#16 0x0000555555a61da0 in dfly::StringMap::iterator::ReallocIfNeeded (this=this@entry=0x7fffe8007fb0, ratio=ratio@entry=0.800000012) at ../src/core/string_map.cc:309
#17 0x0000555555a414ee in dfly::(anonymous namespace)::DefragStrMap2 (ratio=0.800000012, sm=0x339c2401470) at ../src/core/compact_object.cc:157
#18 dfly::(anonymous namespace)::DefragSet (ratio=0.800000012, ptr=0x339c2401470, encoding=<optimized out>) at ../src/core/compact_object.cc:220

[romange]

More stack traces:

#3  0x00007ffff7c4526e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4  0x00005555561da46e in absl::lts_20240116::AbslFailureSignalHandler(int, siginfo_t*, void*) ()
#5  <signal handler called>
#6  0x0000555555b362c3 in mi_slice_first (slice=0x6572012c28006dc8) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:471
#7  _mi_segment_page_of (p=0x6572012c29222c30, segment=<optimized out>) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:486
#8  _mi_ptr_page (p=0x6572012c29222c30) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:502
#9  mi_heap_page_is_underutilized (heap=0x3c1f0110000, p=p@entry=0x6572012c29222c30, ratio=0, ratio@entry=0.800000012) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/src/alloc.c:581
#10 0x0000555555b33906 in zmalloc_page_is_underutilized (ptr=ptr@entry=0x6572012c29222c30, ratio=ratio@entry=0.800000012) at ../src/redis/zmalloc_mi.c:179
#11 0x0000555555a6192a in dfly::StringMap::ReallocIfNeeded (this=<optimized out>, obj=0x3c21f2a9513, ratio=0.800000012) at ../src/core/string_map.cc:198
#12 0x0000555555a61b02 in <lambda(auto:25*)>::operator()<dfly::DenseSet::DensePtr> (ptr=0x3c1f0181b50, __closure=0x3c27a529a20) at ../src/core/string_map.cc:304
#13 std::_Function_handler<void(dfly::DenseSet::DensePtr*), dfly::StringMap::iterator::ReallocIfNeeded(float)::<lambda(auto:25*)> >::_M_invoke(const std::_Any_data &, dfly::DenseSet::DensePtr *&&) (__functor=...,
    __args#0=<optimized out>) at /usr/include/c++/9/bits/std_function.h:300
#14 0x0000555555a47970 in std::function<void (dfly::DenseSet::DensePtr*)>::operator()(dfly::DenseSet::DensePtr*) const (__args#0=<optimized out>, this=0x7fffe8007f50) at /usr/include/c++/9/bits/std_function.h:688
#15 dfly::DenseSet::IteratorBase::TraverseApply(dfly::DenseSet::DensePtr*, std::function<void (dfly::DenseSet::DensePtr*)>) (this=this@entry=0x7fffe8007fb0, ptr=<optimized out>, fun=...) at ../src/core/dense_set.cc:855
#16 0x0000555555a61da0 in dfly::StringMap::iterator::ReallocIfNeeded (this=this@entry=0x7fffe8007fb0, ratio=ratio@entry=0.800000012) at ../src/core/string_map.cc:309
#17 0x0000555555a414ee in dfly::(anonymous namespace)::DefragStrMap2 (ratio=0.800000012, sm=0x3c27102e9f0) at ../src/core/compact_object.cc:157
#18 dfly::(anonymous namespace)::DefragSet (ratio=0.800000012, ptr=0x3c27102e9f0, encoding=<optimized out>) at ../src/core/compact_object.cc:220
#19 <lambda(auto:23)>::operator()<std::pair<void*, bool> (*)(unsigned int, void*, float)> (__closure=<synthetic pointer>, __closure=<synthetic pointer>, defrag_fun=<optimized out>) at ../src/core/compact_object.cc:460
#20 dfly::detail::RobjWrapper::DefragIfNeeded (this=0x3c1f01b6450, ratio=ratio@entry=0.800000012) at ../src/core/compact_object.cc:473
#21 0x0000555555a41ceb in dfly::CompactObj::DefragIfNeeded (this=<optimized out>, ratio=ratio@entry=0.800000012) at ../src/core/compact_object.cc:932
#22 0x0000555555953978 in <lambda(dfly::PrimeIterator)>::operator() (__closure=<optimized out>, it=...) at ../src/server/engine_shard.cc:335
#23 <lambda(const SegmentIterator&)>::operator() (it=..., it=..., this=<optimized out>) at ../src/core/dash.h:945

#6  0x0000555555b362c3 in mi_slice_first (slice=0x130c7bee900026e8) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:471
#7  _mi_segment_page_of (p=0x130c7bee90657065, segment=<optimized out>) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:486
#8  _mi_ptr_page (p=0x130c7bee90657065) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/include/mimalloc/internal.h:502
#9  mi_heap_page_is_underutilized (heap=0x4130c110800, p=p@entry=0x130c7bee90657065, ratio=0, ratio@entry=0.800000012) at /__w/dragonfly/dragonfly/build-release/third_party/mimalloc/src/alloc.c:581
#10 0x0000555555b33906 in zmalloc_page_is_underutilized (ptr=ptr@entry=0x130c7bee90657065, ratio=ratio@entry=0.800000012) at ../src/redis/zmalloc_mi.c:179
#11 0x0000555555a6192a in dfly::StringMap::ReallocIfNeeded (this=<optimized out>, obj=0x4130c7bd7b3, ratio=0.800000012) at ../src/core/string_map.cc:198
#12 0x0000555555a61b02 in <lambda(auto:25*)>::operator()<dfly::DenseSet::DensePtr> (ptr=0x4130c699c50, __closure=0x41390d9c540) at ../src/core/string_map.cc:304
#13 std::_Function_handler<void(dfly::DenseSet::DensePtr*), dfly::StringMap::iterator::ReallocIfNeeded(float)::<lambda(auto:25*)> >::_M_invoke(const std::_Any_data &, dfly::DenseSet::DensePtr *&&) (__functor=...,
    __args#0=<optimized out>) at /usr/include/c++/9/bits/std_function.h:300
#14 0x0000555555a47970 in std::function<void (dfly::DenseSet::DensePtr*)>::operator()(dfly::DenseSet::DensePtr*) const (__args#0=<optimized out>, this=0x7fffe8007f50) at /usr/include/c++/9/bits/std_function.h:688
#15 dfly::DenseSet::IteratorBase::TraverseApply(dfly::DenseSet::DensePtr*, std::function<void (dfly::DenseSet::DensePtr*)>) (this=this@entry=0x7fffe8007fb0, ptr=<optimized out>, fun=...) at ../src/core/dense_set.cc:855
#16 0x0000555555a61da0 in dfly::StringMap::iterator::ReallocIfNeeded (this=this@entry=0x7fffe8007fb0, ratio=ratio@entry=0.800000012) at ../src/core/string_map.cc:309
#17 0x0000555555a414ee in dfly::(anonymous namespace)::DefragStrMap2 (ratio=0.800000012, sm=0x4130c65bf80) at ../src/core/compact_object.cc:157
#18 dfly::(anonymous namespace)::DefragSet (ratio=0.800000012, ptr=0x4130c65bf80, encoding=<optimized out>) at ../src/core/compact_object.cc:220
#19 <lambda(auto:23)>::operator()<std::pair<void*, bool> (*)(unsigned int, void*, float)> (__closure=<synthetic pointer>, __closure=<synthetic pointer>, defrag_fun=<optimized out>) at ../src/core/compact_object.cc:460
#20 dfly::detail::RobjWrapper::DefragIfNeeded (this=0x4130c1b6474, ratio=ratio@entry=0.800000012) at ../src/core/compact_object.cc:473
#21 0x0000555555a41ceb in dfly::CompactObj::DefragIfNeeded (this=<optimized out>, ratio=ratio@entry=0.800000012) at ../src/core/compact_object.cc:932
#22 0x0000555555953978 in <lambda(dfly::PrimeIterator)>::operator() (__closure=<optimized out>, it=...) at ../src/server/engine_shard.cc:335
#23 <lambda(const SegmentIterator&)>::operator() (it=..., it=..., this=<optimized out>) at ../src/core/dash.h:945

[romange]

my intuition is that a pointer passed to zmalloc_page_is_underutilized is invalid.