cql3: Fix use-after-free on statement
cql3: Fix use-after-free on statement

Reported by Pekka:

READ of size 8 at 0x611000062ee8 thread T6
    #0 0x64d20f in std::unique_ptr<cql3::attributes, std::default_delete<cql3::attributes> >::get() const /usr/include/c++/4.9.2/bits/unique_ptr.h:305
    #1 0x641532 in std::unique_ptr<cql3::attributes, std::default_delete<cql3::attributes> >::operator->() const /usr/include/c++/4.9.2/bits/unique_ptr.h:299
    #2 0x63af5b in cql3::statements::modification_statement::get_time_to_live(cql3::query_options const&) const cql3/statements/modification_statement.hh:190
    #3 0x61e072 in _ZZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorI13basic_sstringIcjLj31EESaIS5_EEES2_IS3_INSt12experimental8optionalIS5_EESaISB_EEERKNS_13query_optionsEblENKUlT_E_clINSA_ISt13unordered_mapIS5_St3mapIjN5boost3anyESt4lessIjESaISt4pairIKjSO_EEE15serialized_hash16serialized_equalSaISR_IKS5_SV_EEEEEEEDaSI_ (/home/penberg/urchin/build/debug/seastar+0x61e072)
    #4 0x625ce1 in apply core/apply.hh:34
    #5 0x625df4 in apply<cql3::statements::modification_statement::make_update_parameters(lw_shared_ptr<std::vector<basic_sstring<char, unsigned int, 31u> > >, lw_shared_ptr<std::vector<std::experimental::optional<basic_sstring<char, unsigned int, 31u> > > >, const cql3::query_options&, bool, int64_t)::<lambda(auto:18)>, std::experimental::optional<std::unordered_map<basic_sstring<char, unsigned int, 31u>, std::map<unsigned int, boost::any, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, boost::any> > >, serialized_hash, serialized_equal, std::allocator<std::pair<const basic_sstring<char, unsigned int, 31u>, std::map<unsigned int, boost::any, std::less<unsigned int>, std::allocator<std::pair<unsigned int const, boost::any> > > > > > > > core/apply.hh:41
    #6 0x628354 in _ZZN6futureIINSt12experimental8optionalISt13unordered_mapI13basic_sstringIcjLj31EESt3mapIjN5boost3anyESt4lessIjESaISt4pairIKjS7_EEE15serialized_hash16serialized_equalSaISA_IKS4_SE_EEEEEEE4thenIZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorIS4_SaIS4_EEESR_ISS_INS1_IS4_EESaISW_EEERKNSO_13query_optionsEblEUlT_E_EENSt9result_ofIFT_OSL_EE4typeEOS16_NSt9enable_ifIXsr9is_futureIIS1A_EE5valueEPvE4typeEENUlRS13_E_clI12future_stateIISL_EEEEDaRS16_ (/home/penberg/urchin/build/debug/seastar+0x628354)
    #7 0x628503 in _ZZN6futureIINSt12experimental8optionalISt13unordered_mapI13basic_sstringIcjLj31EESt3mapIjN5boost3anyESt4lessIjESaISt4pairIKjS7_EEE15serialized_hash16serialized_equalSaISA_IKS4_SE_EEEEEEE8scheduleIZNSM_4thenIZN4cql310statements22modification_statement22make_update_parametersE13lw_shared_ptrISt6vectorIS4_SaIS4_EEESS_IST_INS1_IS4_EESaISX_EEERKNSP_13query_optionsEblEUlT_E_EENSt9result_ofIFT_OSL_EE4typeEOS17_NSt9enable_ifIXsr9is_futureIIS1B_EE5valueEPvE4typeEEUlRS14_E_EEvS1C_EN21task_with_ready_state3runEv (/home/penberg/urchin/build/debug/seastar+0x628503)
    #8 0x7a6600 in reactor::run_tasks(circular_buffer<std::unique_ptr<task, std::default_delete<task> >, std::allocator<std::unique_ptr<task, std::default_delete<task> > > >&, unsigned long) core/reactor.cc:691
    #9 0x7a8ccc in reactor::run() core/reactor.cc:785
    #10 0x7b0bef in smp::configure(boost::program_options::variables_map)::{lambda()#1}::operator()() const (/home/penberg/urchin/build/debug/seastar+0x7b0bef)
    #11 0x84011d in _M_invoke /usr/include/c++/4.9.2/functional:2039
    #12 0x860c97 in std::function<void ()>::operator()() const /usr/include/c++/4.9.2/functional:2439
    #13 0x8e45fa in posix_thread::start_routine(void*) core/posix.cc:50
    #14 0x7f25abb05529 in start_thread (/lib64/libpthread.so.0+0x7529)
    #15 0x7f25ab84179c in __clone (/lib64/libc.so.6+0x10079c)

0x611000062ee8 is located 40 bytes inside of 216-byte region [0x611000062ec0,0x611000062f98)
freed by thread T6 here:
    #0 0x7f25af4bf64f in operator delete(void*) (/lib64/libasan.so.1+0x5864f)
    #1 0x684dbf in shared_ptr_count_for<cql3::statements::update_statement>::~shared_ptr_count_for() core/shared_ptr.hh:261
    #2 0x63de36 in shared_ptr<cql3::cql_statement>::~shared_ptr() core/shared_ptr.hh:326
    #3 0x772711 in cql3::statements::parsed_statement::prepared::~prepared() cql3/statements/parsed_statement.hh:60
    #4 0x77591d in std::default_delete<cql3::statements::parsed_statement::prepared>::operator()(cql3::statements::parsed_statement::prepared*) const /usr/include/c++/4.9.2/bits/unique_ptr.h:76
    #5 0x772cef in std::unique_ptr<cql3::statements::parsed_statement::prepared, std::default_delete<cql3::statements::parsed_statement::prepared> >::~unique_ptr() /usr/include/c++/4.9.2/bits/unique_ptr.h:236
    #6 0x76c8ea in cql3::query_processor::process(std::experimental::basic_string_view<char, std::char_traits<char> > const&, service::query_state&, cql3::query_options&) cql3/query_processor.cc:51
    #7 0x554e9c in cql_server::connection::process_query(unsigned short, temporary_buffer<char>) transport/server.cc:408
    #8 0x553a7a in cql_server::connection::process_request()::{lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)#1}::operator()(future<std::experimental::optional<cql_binary_frame_v3> >&&) const::{lambda(temporary_buffer<char>)#1}::operator()(temporary_buffer) const (/home/penberg/urchin/build/debug/seastar+0x553a7a)
    #9 0x55df9e in apply core/apply.hh:34
    #10 0x55e0b1 in apply<cql_server::connection::process_request()::<lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)>::<lambda(temporary_buffer<char>)>, temporary_buffer<char> > core/apply.hh:41
    #11 0x55e43b in then<cql_server::connection::process_request()::<lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)>::<lambda(temporary_buffer<char>)> > core/future.hh:480
    #12 0x5542c1 in cql_server::connection::process_request()::{lambda(future<std::experimental::optional<cql_binary_frame_v3> >&&)#1}::operator()(future<std::experimental::optional<cql_binary_frame_v3> >&&) const (/home/penberg/urchin/build/debug/seastar+0x5542c1)
    #13 0x564846 in _ZZNO6futureIINSt12experimental8optionalI19cql_binary_frame_v3EEEE12then_wrappedIZN10cql_server10connection15process_requestEvEUlOS4_E_EENSt9result_ofIFT_S4_EE4typeEOSB_ENUlRT_E_clI12future_stateIIS3_EEEEDaRSB_ (/home/penberg/urchin/build/debug/seastar+0x564846)
    #14 0x5649c7 in _ZZN7promiseIINSt12experimental8optionalI19cql_binary_frame_v3EEEE8scheduleIZNO6futureIIS3_EE12then_wrappedIZN10cql_server10connection15process_requestEvEUlOS7_E_EENSt9result_ofIFT_S7_EE4typeEOSE_EUlRT_E_EEvSI_EN15task_with_state3runEv (/home/penberg/urchin/build/debug/seastar+0x5649c7)
    #15 0x7a6600 in reactor::run_tasks(circular_buffer<std::unique_ptr<task, std::default_delete<task> >, std::allocator<std::unique_ptr<task, std::default_delete<task> > > >&, unsigned long) core/reactor.cc:691
    #16 0x7a8ccc in reactor::run() core/reactor.cc:785
    #17 0x7b0bef in smp::configure(boost::program_options::variables_map)::{lambda()#1}::operator()() const (/home/penberg/urchin/build/debug/seastar+0x7b0bef)
    #18 0x84011d in _M_invoke /usr/include/c++/4.9.2/functional:2039
    #19 0x860c97 in std::function<void ()>::operator()() const /usr/include/c++/4.9.2/functional:2439
    #20 0x8e45fa in posix_thread::start_routine(void*) core/posix.cc:50
    #21 0x7f25abb05529 in start_thread (/lib64/libpthread.so.0+0x7529)

Signed-off-by: Tomasz Grabiec <5b6f5bb8c48333808ed72246428f3dc778928cb4@cloudius-systems.com>

rluta/scylla,raphaelsc/scylla,victorbriz/scylla,guiquanz/scylla,dwdm/scylla,scylladb/scylla,glommer/scylla,rluta/scylla,avikivity/scylla,avikivity/scylla,rluta/scylla,avikivity/scylla,duarten/scylla,scylladb/scylla,guiquanz/scylla,phonkee/scylla,acbellini/scylla,rentongzhang/scylla,capturePointer/scylla,victorbriz/scylla,stamhe/scylla,justintung/scylla,eklitzke/scylla,scylladb/scylla,capturePointer/scylla,raphaelsc/scylla,duarten/scylla,wildinto/scylla,kangkot/scylla,wildinto/scylla,dwdm/scylla,acbellini/scylla,guiquanz/scylla,bowlofstew/scylla,linearregression/scylla,gwicke/scylla,stamhe/scylla,glommer/scylla,rentongzhang/scylla,capturePointer/scylla,aruanruan/scylla,dwdm/scylla,asias/scylla,kangkot/scylla,asias/scylla,respu/scylla,respu/scylla,aruanruan/scylla,justintung/scylla,gwicke/scylla,linearregression/scylla,shaunstanislaus/scylla,duarten/scylla,eklitzke/scylla,acbellini/scylla,glommer/scylla,senseb/scylla,tempbottle/scylla,senseb/scylla,shaunstanislaus/scylla,senseb/scylla,phonkee/scylla,rentongzhang/scylla,wildinto/scylla,respu/scylla,bowlofstew/scylla,tempbottle/scylla,eklitzke/scylla,kjniemi/scylla,raphaelsc/scylla,bowlofstew/scylla,shaunstanislaus/scylla,tempbottle/scylla,kangkot/scylla,phonkee/scylla,linearregression/scylla,victorbriz/scylla,scylladb/scylla,kjniemi/scylla,justintung/scylla,kjniemi/scylla,asias/scylla,stamhe/scylla,aruanruan/scylla,gwicke/scylla