test/rbd_mirror: flush watch/notify callbacks in TestImageReplayer

TestImageReplayer establishes its own (i.e. outside of the SUT code)
watch on the header of the remote image to be able to synchronize the
execution of the test with certain notifications.  This watch is
established before the remote image is opened and is teared down until
after the remote image is closed but while the image replayer is still
running.  The flush that is part of image close sequence thus isn't
guaranteed to cover all callbacks, especially for snapshot-based
mirroring where UnlinkPeerRequest spawned from Replayer::unlink_peer()
generates a notification on the remote image for each completed unlink.
Since TestImageReplayer further immediately deletes C_WatchCtx, pretty
much any test can segfault when C_WatchCtx::handle_notify() is invoked
by TestWatchNotify infrastructure.  Because it's a virtual method, the
segfault often involves a completely bogus instruction pointer:

  fn_anonymous[3176255]: segfault at b ip 000000000000000b sp 00007fffbceba7a8 error 14 in unittest_rbd_mirror[555555554000+96a000]
  Code: Bad RIP value.

Fixes: https://tracker.ceph.com/issues/63798
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

diff --git a/src/test/rbd_mirror/test_ImageReplayer.cc b/src/test/rbd_mirror/test_ImageReplayer.cc
index 360c85a76b602ca38b0eeb72c9497be9076a4c34..d0bbfb094789a1dea1890dc1f01bf5e84056cb7b 100644 (file)
--- a/src/test/rbd_mirror/test_ImageReplayer.cc
+++ b/src/test/rbd_mirror/test_ImageReplayer.cc
@@ -245,6 +245,7 @@ public:
   void unwatch() {
     if (m_watch_handle != 0) {
       m_remote_ioctx.unwatch2(m_watch_handle);
+      m_remote_cluster.watch_flush();
       delete m_watch_ctx;
       m_watch_ctx = nullptr;
       m_watch_handle = 0;