test/rbd_mirror: flush watch/notify callbacks in TestImageReplayer

TestImageReplayer establishes its own (i.e. outside of the SUT code)
watch on the header of the remote image to be able to synchronize the
execution of the test with certain notifications.  This watch is
established before the remote image is opened and is teared down until
after the remote image is closed but while the image replayer is still
running.  The flush that is part of image close sequence thus isn't
guaranteed to cover all callbacks, especially for snapshot-based
mirroring where UnlinkPeerRequest spawned from Replayer::unlink_peer()
generates a notification on the remote image for each completed unlink.
Since TestImageReplayer further immediately deletes C_WatchCtx, pretty
much any test can segfault when C_WatchCtx::handle_notify() is invoked
by TestWatchNotify infrastructure.  Because it's a virtual method, the
segfault often involves a completely bogus instruction pointer:

  fn_anonymous[3176255]: segfault at b ip 000000000000000b sp 00007fffbceba7a8 error 14 in unittest_rbd_mirror[555555554000+96a000]
  Code: Bad RIP value.

Fixes: https://tracker.ceph.com/issues/63798
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit 5d111e23b89228d75daeada65067765333eefb73)

diff --git a/src/test/rbd_mirror/test_ImageReplayer.cc b/src/test/rbd_mirror/test_ImageReplayer.cc
index abe163cfd6925c1ea39cc4ba972d8f83e2969418..2aa1718834080ee4a589f8f2643bfa54e3bd907a 100644 (file)
--- a/src/test/rbd_mirror/test_ImageReplayer.cc
+++ b/src/test/rbd_mirror/test_ImageReplayer.cc
@@ -243,6 +243,7 @@ public:
   void unwatch() {
     if (m_watch_handle != 0) {
       m_remote_ioctx.unwatch2(m_watch_handle);
+      m_remote_cluster.watch_flush();
       delete m_watch_ctx;
       m_watch_ctx = nullptr;
       m_watch_handle = 0;