Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21069

Crash on DROP TABLE if the data file is corrupted




      I wanted to see if the MDEV-20934 test case covers the case where the change buffer contains entries that are beyond the end of the tablespace. It seems to be fine, but the test will crash on DROP TABLE because the .ibd file is corrupted:

      diff --git a/mysql-test/suite/innodb/t/ibuf_not_empty.test b/mysql-test/suite/innodb/t/ibuf_not_empty.test
      index 8b16d197e03..a5093892b35 100644
      --- a/mysql-test/suite/innodb/t/ibuf_not_empty.test
      +++ b/mysql-test/suite/innodb/t/ibuf_not_empty.test
      @@ -73,8 +73,32 @@ EOF
       --replace_regex /contains \d+ entries/contains #### entries/
       check table t1;
      +--source include/shutdown_mysqld.inc
      +# Truncate the file to 5 pages, as if it were empty
      +do "$ENV{MTR_SUITE_DIR}/include/crc32.pl";
      +my $file = "$ENV{MYSQLD_DATADIR}/test/t1.ibd";
      +open(FILE, "+<$file") || die "Unable to open $file";
      +binmode FILE;
      +my $ps= $ENV{PAGE_SIZE};
      +my $pages=5;
      +my $page;
      +die "Unable to read $file" unless sysread(FILE, $page, $ps) == $ps;
      +substr($page,46,4)=pack("N", $pages);
      +my $polynomial = 0x82f63b78; # CRC-32C
      +my $ck= pack("N",mycrc32(substr($page, 4, 22), 0, $polynomial) ^
      +		 mycrc32(substr($page, 38, $ps - 38 - 8), 0, $polynomial));
      +sysseek(FILE, 0, 0) || die "Unable to rewind $file\n";
      +syswrite(FILE, $page, $ps)==$ps || die "Unable to write $file\n";
      +truncate(FILE, $ps * $pages);
      +close(FILE) || die "Unable to close $file";
       --let $restart_parameters=
      ---source include/restart_mysqld.inc
      +--source include/start_mysqld.inc
       SET GLOBAL innodb_fast_shutdown=0;
       --source include/restart_mysqld.inc

      10.2 bd2b05df6c5806e599698eb239b3e44b971eb031

      CURRENT_TEST: innodb.ibuf_not_empty
      mysqltest: At line 106: query 'DROP TABLE t1' failed: 2013: Lost connection to MySQL server during query
      Version: '10.2.30-MariaDB-debug-log'  socket: '/mariadb/10.2/build/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
      mysqld: /mariadb/10.2/storage/innobase/fsp/fsp0fsp.cc:204: ulint xdes_mtr_get_bit(const xdes_t *, ulint, ulint, mtr_t *): Assertion `(mtr)->memo_contains_page_flagged((descr), (MTR_MEMO_PAGE_SX_FIX))' failed.
      #7  0x0000562e4329d129 in fseg_free_page_low (seg_inode=<optimized out>, space=<optimized out>, offset=17, page_size=..., ahi=<optimized out>, mtr=0x7fec0564ca38) at /mariadb/10.2/storage/innobase/fsp/fsp0fsp.cc:3098
      #8  0x0000562e4329e7d2 in fseg_free_step_func (header=0x7fec05e3804a "", ahi=true, mtr=0x7fec0564ca38) at /mariadb/10.2/storage/innobase/fsp/fsp0fsp.cc:3330
      #9  0x0000562e43190c7b in btr_free_but_not_root (block=0x7fec0592be90, log_mode=MTR_LOG_ALL) at /mariadb/10.2/storage/innobase/btr/btr0btr.cc:1256
      #10 0x0000562e4319090c in btr_free_if_exists (page_id=..., page_size=..., index_id=21, mtr=0x7fec0564d548) at /mariadb/10.2/storage/innobase/btr/btr0btr.cc:1305
      #11 0x0000562e43228408 in dict_drop_index_tree (rec=<optimized out>, pcur=<optimized out>, mtr=0x7fec0564d548) at /mariadb/10.2/storage/innobase/dict/dict0crea.cc:1019
      #12 0x0000562e43112b36 in row_upd_clust_step (node=0x7febb40417a8, thr=0x7febb4043608) at /mariadb/10.2/storage/innobase/row/row0upd.cc:3125
      #13 row_upd (node=0x7febb40417a8, thr=<optimized out>) at /mariadb/10.2/storage/innobase/row/row0upd.cc:3291
      #14 0x0000562e431123f3 in row_upd_step (thr=0x7febb4043608) at /mariadb/10.2/storage/innobase/row/row0upd.cc:3437
      #15 0x0000562e4307c256 in que_thr_step (thr=<optimized out>) at /mariadb/10.2/storage/innobase/que/que0que.cc:1022
      #16 que_run_threads_low (thr=0x7febb4043608) at /mariadb/10.2/storage/innobase/que/que0que.cc:1102
      #17 que_run_threads (thr=0x7febb4043608) at /mariadb/10.2/storage/innobase/que/que0que.cc:1142
      #18 0x0000562e4307cd13 in que_eval_sql (info=0x7febb4047a48, sql=0x562e435eadb7 "PROCEDURE DROP_TABLE_PROC () IS\ntid CHAR;\niid CHAR;\nDECLARE CURSOR cur_idx IS\nSELECT ID FROM SYS_INDEXES\nWHERE TABLE_ID = tid FOR UPDATE;\nBEGIN\nSELECT ID INTO tid FROM SYS_TABLES\nWHERE NAME = :name FO"..., reserve_dict_mutex=0, trx=0x7fec0623c268) at /mariadb/10.2/storage/innobase/que/que0que.cc:1219
      #19 0x0000562e430c65bc in row_drop_table_for_mysql (name=<optimized out>, trx=0x7fec0623c268, sqlcom=SQLCOM_DROP_TABLE, create_failed=96, nonatomic=<optimized out>) at /mariadb/10.2/storage/innobase/row/row0mysql.cc:3632
      #20 0x0000562e42fb9805 in ha_innobase::delete_table (this=<optimized out>, name=0x7fec0564fff0 "./test/t1", sqlcom=SQLCOM_DROP_TABLE) at /mariadb/10.2/storage/innobase/handler/ha_innodb.cc:13392

      The call to btr_free_if_exists() seems totally unnecessary in this case, because we are going to delete the entire .ibd file.


          Issue Links



              marko Marko Mäkelä
              marko Marko Mäkelä
              1 Vote for this issue
              3 Start watching this issue