Fix problem causing free-list corruption when merging free-lists for two

concurrent transactions that have both used page X as an in-memory free-list
trunk page, where X lies past the end of the initial database images.

FossilOrigin-Name: dc0fc2aa7cbefeb5f0ba8c992fd3e9adcfb5a4d61e2321c1bd93f4d36ba9aafc

manifest

@@ -1,5 +1,5 @@
-C Fix\sa\sspurious\sSQLITE_CORRUPT\serror\sthat\scould\soccur\swithin\sa\sCOMMIT\sof\sa\nconcurrent\stransaction.
-D 2018-01-02T19:57:26.765
+C Fix\sproblem\scausing\sfree-list\scorruption\swhen\smerging\sfree-lists\sfor\stwo\nconcurrent\stransactions\sthat\shave\sboth\sused\spage\sX\sas\san\sin-memory\sfree-list\ntrunk\spage,\swhere\sX\slies\spast\sthe\send\sof\sthe\sinitial\sdatabase\simages.
+D 2018-01-04T18:36:39.212
 F Makefile.in b142eb20482922153ebc77b261cdfd0a560ed05a81e9f6d9a2b0e8192922a1d2
 F Makefile.linux-gcc 7bc79876b875010e8c8f9502eb935ca92aa3c434
 F Makefile.msc a55372a22454e742ba7c8f6edf05b83213ec01125166ad7dcee0567e2f7fc81b
@@ -416,7 +416,7 @@ F src/auth.c 6277d63837357549fe14e723490d6dc1a38768d71c795c5eb5c0f8a99f918f73
 F src/backup.c faf17e60b43233c214aae6a8179d24503a61e83b
 F src/bitvec.c 8433d9e98dd6f2ea3286e0d2fe5d65de1bfc18a706486eb2026b01be066b5806
 F src/btmutex.c 0e9ce2d56159b89b9bc8e197e023ee11e39ff8ca
-F src/btree.c c3e15a9e5726fa3f426322cccaf9fe972dc9b3d9e07921220286f9076413f71d
+F src/btree.c 8cbe0ce25607b0a64b44dbf9d018d0d667569b5966ad1bd40f27f95d65ce4284
 F src/btree.h feafd0647331366f4ef17f7e68597e9029f001e7ab16a125e2f176c598a7ef4a
 F src/btreeInt.h 0e0abe97427b4139092ec8782d396a4ad18566964e992c60043e370d4c86fd99
 F src/build.c f890a66f2b78cd820b21b580f37605f8dd77f19d0b35f5850a675c88a815adca
@@ -687,6 +687,7 @@ F test/concurrent3.test f4af1cf1220908c6dd5694923621c19e999b78cd997e2646285f08a5
 F test/concurrent4.test e0b12cd467137e50259df3b4f837507e82aaa07c35941c88664dc8ed1d089c44
 F test/concurrent5.test d5d7d9d404a9b4502464fc097c1fc5c3012bb4f1b063fae7ad707ca983fc86c5
 F test/concurrent6.test a7860e9ca13bb5fb76bcf41c5524fbfa9c37e6e258ecf84ffb5748a272488c67
+F test/concurrent7.test b96fa5c4cfdf8d5c0bc66b6934214500bad0260884a736f054ccc76e81aae85d
 F test/conflict.test 029faa2d81a0d1cafb5f88614beb663d972c01db
 F test/conflict2.test bb0b94cf7196c64a3cbd815c66d3ee98c2fecd9c
 F test/conflict3.test a83db76a6c3503b2fa057c7bfb08c318d8a422202d8bc5b86226e078e5b49ff9
@@ -1687,7 +1688,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 3fde0b4d05c249b9d2a54dd721185202c353cee23c0351b634cac349dc0a7b14
-R 131f3c49cbacffd5469d66a498022e8f
+P 50c8952c92b9f0c61935fb0df04ed1426d9e266a812071b7bf5b0215c5552757
+R 27d77b980c6b081a9288d237e34b2379
 U dan
-Z 25c8423f0f81f25c528eab1972eef804
+Z 38a96e74ef2f420253bcb0ab74b036ef

manifest.uuid

@@ -1 +1 @@
-50c8952c92b9f0c61935fb0df04ed1426d9e266a812071b7bf5b0215c5552757
+dc0fc2aa7cbefeb5f0ba8c992fd3e9adcfb5a4d61e2321c1bd93f4d36ba9aafc

src/btree.c

@@ -4095,7 +4095,10 @@ static int btreeRelocateRange(
     if( pEntry->eType==PTRMAP_FREEPAGE ){
       Pgno dummy;
       rc = allocateBtreePage(pBt, &pFree, &dummy, iPg, BTALLOC_EXACT);
-      releasePage(pFree);
+      if( pFree ){
+        assert( sqlite3PagerPageRefcount(pFree->pDbPage)==1 );
+        sqlite3PcacheDrop(pFree->pDbPage);
+      }
       assert( rc!=SQLITE_OK || dummy==iPg );
     }else if( pnCurrent ){
       btreeGetPage(pBt, iPg, &pPg, 0);

test/concurrent7.test

@@ -0,0 +1,52 @@
+# 2018 Jan 5
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set ::testprefix concurrent7
+
+sqlite3 db2 test.db
+
+do_execsql_test 1 {
+  PRAGMA journal_mode = wal;
+  CREATE TABLE t1(x);
+  CREATE TABLE t2(x);
+} {wal}
+
+do_execsql_test -db db2 2 {
+  SELECT * FROM t1;
+}
+
+do_execsql_test 3 {
+  BEGIN CONCURRENT;
+    INSERT INTO t1 VALUES(randomblob(1500));
+    INSERT INTO t1 VALUES(randomblob(1500));
+    DELETE FROM t1 WHERE rowid = 1;
+}
+
+do_execsql_test -db db2 4 {
+  INSERT INTO t2 VALUES(randomblob(1500));
+  INSERT INTO t2 VALUES(randomblob(1500));
+  INSERT INTO t2 VALUES(randomblob(1500));
+  INSERT INTO t2 VALUES(randomblob(1500));
+  DELETE FROM t2 WHERE rowid IN (1, 2);
+}
+
+do_execsql_test 5 {
+  COMMIT;
+  PRAGMA integrity_check;
+} {ok}
+
+finish_test
+
+