Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21485

ASAN use-after-poison in dfield_get_len or Assertion `pos < index->n_def' failed

Details

    Description

      --source include/have_innodb.inc
       
      CREATE TABLE t1 (a INT, b INT, PRIMARY KEY(a,b)) ENGINE=InnoDB;
      ALTER TABLE t1 MODIFY b INT FIRST;
       
      # Cleanup
      DROP TABLE t1;
      

      10.4 ASAN 2d4b6571

      ==16349==ERROR: AddressSanitizer: use-after-poison on address 0x61e00002addc at pc 0x55dea553a60e bp 0x7f40e4d57410 sp 0x7f40e4d57408
      READ of size 4 at 0x61e00002addc thread T27
          #0 0x55dea553a60d in dfield_get_len(dfield_t const*) /data/src/10.4/storage/innobase/include/data0data.h:593
          #1 0x55dea574fa5d in rec_get_converted_size_comp_prefix_low<true> /data/src/10.4/storage/innobase/rem/rem0rec.cc:1161
          #2 0x55dea5742603 in rec_get_converted_size_comp(dict_index_t const*, dtuple_t const*, unsigned long*) /data/src/10.4/storage/innobase/rem/rem0rec.cc:1297
          #3 0x55dea5a89169 in rec_get_converted_size /data/src/10.4/storage/innobase/include/rem0rec.ic:1388
          #4 0x55dea5a8bdee in dtuple_convert_big_rec(dict_index_t*, upd_t*, dtuple_t*, unsigned long*) /data/src/10.4/storage/innobase/data/data0data.cc:621
          #5 0x55dea59bcfb8 in btr_cur_optimistic_insert(unsigned long, btr_cur_t*, unsigned short**, mem_block_info_t**, dtuple_t*, unsigned char**, big_rec_t**, unsigned long, que_thr_t*, mtr_t*) /data/src/10.4/storage/innobase/btr/btr0cur.cc:3438
          #6 0x55dea57972d3 in row_ins_clust_index_entry_low(unsigned long, unsigned long, dict_index_t*, unsigned long, dtuple_t*, unsigned long, que_thr_t*) /data/src/10.4/storage/innobase/row/row0ins.cc:2777
          #7 0x55dea557ab50 in innobase_instant_try /data/src/10.4/storage/innobase/handler/handler0alter.cc:5917
          #8 0x55dea55c2692 in commit_try_norebuild(Alter_inplace_info*, ha_innobase_inplace_ctx*, TABLE*, TABLE const*, trx_t*, char const*) (/data/bld/10.4-asan/bin/mysqld+0x201d692)
          #9 0x55dea559dd14 in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.4/storage/innobase/handler/handler0alter.cc:10900
          #10 0x55dea4fcfe72 in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.4/sql/handler.cc:4568
          #11 0x55dea4a7565e in mysql_inplace_alter_table /data/src/10.4/sql/sql_table.cc:7776
          #12 0x55dea4a83b08 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.4/sql/sql_table.cc:10119
          #13 0x55dea4bdba6b in Sql_cmd_alter_table::execute(THD*) /data/src/10.4/sql/sql_alter.cc:508
          #14 0x55dea485eea3 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6102
          #15 0x55dea486986d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7901
          #16 0x55dea4842b20 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1842
          #17 0x55dea483fa20 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1360
          #18 0x55dea4bc6730 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
          #19 0x55dea4bc60e4 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
          #20 0x55dea602c919 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #21 0x7f40fc9bb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
          #22 0x7f40faaefd0e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0xe8d0e)
       
      0x61e00002addc is located 348 bytes inside of 2456-byte region [0x61e00002ac80,0x61e00002b618)
      allocated by thread T27 here:
          #0 0x7f40fcc92d28 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.3+0xc1d28)
          #1 0x55dea569e899 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, char const*, unsigned int, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:280
          #2 0x55dea569effe in mem_heap_add_block(mem_block_info_t*, unsigned long) /data/src/10.4/storage/innobase/mem/mem0mem.cc:386
          #3 0x55dea5556390 in mem_heap_alloc /data/src/10.4/storage/innobase/include/mem0mem.ic:203
          #4 0x55dea5556e15 in dtuple_create_with_vcol /data/src/10.4/storage/innobase/include/data0data.ic:405
          #5 0x55dea5556d5d in dtuple_create /data/src/10.4/storage/innobase/include/data0data.ic:383
          #6 0x55dea55bd96b in dict_index_t::instant_metadata(dtuple_t const&, mem_block_info_t*) const (/data/bld/10.4-asan/bin/mysqld+0x201896b)
          #7 0x55dea557932d in innobase_instant_try /data/src/10.4/storage/innobase/handler/handler0alter.cc:5782
          #8 0x55dea55c2692 in commit_try_norebuild(Alter_inplace_info*, ha_innobase_inplace_ctx*, TABLE*, TABLE const*, trx_t*, char const*) (/data/bld/10.4-asan/bin/mysqld+0x201d692)
          #9 0x55dea559dd14 in ha_innobase::commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.4/storage/innobase/handler/handler0alter.cc:10900
          #10 0x55dea4fcfe72 in handler::ha_commit_inplace_alter_table(TABLE*, Alter_inplace_info*, bool) /data/src/10.4/sql/handler.cc:4568
          #11 0x55dea4a7565e in mysql_inplace_alter_table /data/src/10.4/sql/sql_table.cc:7776
          #12 0x55dea4a83b08 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.4/sql/sql_table.cc:10119
          #13 0x55dea4bdba6b in Sql_cmd_alter_table::execute(THD*) /data/src/10.4/sql/sql_alter.cc:508
          #14 0x55dea485eea3 in mysql_execute_command(THD*) /data/src/10.4/sql/sql_parse.cc:6102
          #15 0x55dea486986d in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.4/sql/sql_parse.cc:7901
          #16 0x55dea4842b20 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.4/sql/sql_parse.cc:1842
          #17 0x55dea483fa20 in do_command(THD*) /data/src/10.4/sql/sql_parse.cc:1360
          #18 0x55dea4bc6730 in do_handle_one_connection(CONNECT*) /data/src/10.4/sql/sql_connect.cc:1412
          #19 0x55dea4bc60e4 in handle_one_connection /data/src/10.4/sql/sql_connect.cc:1316
          #20 0x55dea602c919 in pfs_spawn_thread /data/src/10.4/storage/perfschema/pfs.cc:1862
          #21 0x7f40fc9bb4a3 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x74a3)
       
      Thread T27 created by T0 here:
          #0 0x7f40fcc01f59 in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.3+0x30f59)
          #1 0x55dea602cd06 in spawn_thread_v1 /data/src/10.4/storage/perfschema/pfs.cc:1912
          #2 0x55dea4598b78 in inline_mysql_thread_create /data/src/10.4/include/mysql/psi/mysql_thread.h:1268
          #3 0x55dea45ad11c in create_thread_to_handle_connection(CONNECT*) /data/src/10.4/sql/mysqld.cc:6234
          #4 0x55dea45ad7ff in create_new_thread(CONNECT*) /data/src/10.4/sql/mysqld.cc:6304
          #5 0x55dea45adb8a in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /data/src/10.4/sql/mysqld.cc:6402
          #6 0x55dea45ae7dc in handle_connections_sockets() /data/src/10.4/sql/mysqld.cc:6560
          #7 0x55dea45ac99d in mysqld_main(int, char**) /data/src/10.4/sql/mysqld.cc:5892
          #8 0x55dea4596a5f in main /data/src/10.4/sql/main.cc:25
          #9 0x7f40faa272e0 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x202e0)
       
      SUMMARY: AddressSanitizer: use-after-poison /data/src/10.4/storage/innobase/include/data0data.h:593 in dfield_get_len(dfield_t const*)
      Shadow bytes around the buggy address:
        0x0c3c7fffd560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffd570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffd580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c3c7fffd590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3c7fffd5a0: 00 f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      =>0x0c3c7fffd5b0: 00 00 00 00 00 00 00 00 00 00 f7[04]f7 00 00 00
        0x0c3c7fffd5c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        0x0c3c7fffd5d0: 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00
        0x0c3c7fffd5e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f7 f7
        0x0c3c7fffd5f0: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
        0x0c3c7fffd600: f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7 f7
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Heap right redzone:      fb
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack partial redzone:   f4
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
      ==16349==ABORTING
      

      10.4 debug 2d4b6571

      mysqld: /data/src/10.4/storage/innobase/include/dict0dict.ic:839: dict_field_t* dict_index_get_nth_field(const dict_index_t*, ulint): Assertion `pos < index->n_def' failed.
      200115 15:13:09 [ERROR] mysqld got signal 6 ;
       
      #7  0x00007f31b0d6bf12 in __GI___assert_fail (assertion=0x55a9507f2441 "pos < index->n_def", file=0x55a9507f2380 "/data/src/10.4/storage/innobase/include/dict0dict.ic", line=839, function=0x55a9507f48c0 <_ZZL24dict_index_get_nth_fieldPK12dict_index_tmE19__PRETTY_FUNCTION__> "dict_field_t* dict_index_get_nth_field(const dict_index_t*, ulint)") at assert.c:101
      #8  0x000055a94ff72a8f in dict_index_get_nth_field (index=0x7f31581a0768, pos=4) at /data/src/10.4/storage/innobase/include/dict0dict.ic:839
      #9  0x000055a94ff7f56f in rec_get_converted_size_comp_prefix_low<true> (index=0x7f31581a0768, dfield=0x7f31581505e8, n_fields=5, extra=0x0, status=REC_STATUS_INSTANT, temp=false) at /data/src/10.4/storage/innobase/rem/rem0rec.cc:1163
      #10 0x000055a94ff77e2a in rec_get_converted_size_comp (index=0x7f31581a0768, tuple=0x7f3158150528, extra=0x0) at /data/src/10.4/storage/innobase/rem/rem0rec.cc:1297
      #11 0x000055a95017139a in rec_get_converted_size (index=0x7f31581a0768, dtuple=0x7f3158150528, n_ext=0) at /data/src/10.4/storage/innobase/include/rem0rec.ic:1388
      #12 0x000055a950172fea in dtuple_convert_big_rec (index=0x7f31581a0768, upd=0x0, entry=0x7f3158150528, n_ext=0x7f31ac0c41f8) at /data/src/10.4/storage/innobase/data/data0data.cc:621
      #13 0x000055a9500f296a in btr_cur_optimistic_insert (flags=2, cursor=0x7f31ac0c42d0, offsets=0x7f31ac0c4268, heap=0x7f31ac0c4260, entry=0x7f3158150528, rec=0x7f31ac0c4270, big_rec=0x7f31ac0c4258, n_ext=0, thr=0x7f31581506b0, mtr=0x7f31ac0c4630) at /data/src/10.4/storage/innobase/btr/btr0cur.cc:3438
      #14 0x000055a94ffa8961 in row_ins_clust_index_entry_low (flags=2, mode=33, index=0x7f31581a0768, n_uniq=2, entry=0x7f3158150528, n_ext=0, thr=0x7f31581506b0) at /data/src/10.4/storage/innobase/row/row0ins.cc:2777
      #15 0x000055a94fe6bb95 in innobase_instant_try (ha_alter_info=0x7f31ac0c6770, ctx=0x7f3158014a00, altered_table=0x7f31ac0c6800, table=0x7f315819edb0, trx=0x7f31a6a74268) at /data/src/10.4/storage/innobase/handler/handler0alter.cc:5917
      #16 0x000055a94fe8e9d7 in commit_try_norebuild (ha_alter_info=0x7f31ac0c6770, ctx=0x7f3158014a00, altered_table=0x7f31ac0c6800, old_table=0x7f315819edb0, trx=0x7f31a6a74268, table_name=0x7f315800ab3d "t1") at /data/src/10.4/storage/innobase/handler/handler0alter.cc:10149
      #17 0x000055a94fe7c9f3 in ha_innobase::commit_inplace_alter_table (this=0x7f315819fc18, altered_table=0x7f31ac0c6800, ha_alter_info=0x7f31ac0c6770, commit=true) at /data/src/10.4/storage/innobase/handler/handler0alter.cc:10900
      #18 0x000055a94fbe9be7 in handler::ha_commit_inplace_alter_table (this=0x7f315819fc18, altered_table=0x7f31ac0c6800, ha_alter_info=0x7f31ac0c6770, commit=true) at /data/src/10.4/sql/handler.cc:4568
      #19 0x000055a94f96b5de in mysql_inplace_alter_table (thd=0x7f3158000af0, table_list=0x7f3158013288, table=0x7f315819edb0, altered_table=0x7f31ac0c6800, ha_alter_info=0x7f31ac0c6770, inplace_supported=HA_ALTER_INPLACE_INSTANT, target_mdl_request=0x7f31ac0c75d0, alter_ctx=0x7f31ac0c8100) at /data/src/10.4/sql/sql_table.cc:7776
      #20 0x000055a94f972231 in mysql_alter_table (thd=0x7f3158000af0, new_db=0x7f31580052b0, new_name=0x7f31580056b8, create_info=0x7f31ac0c8cf0, table_list=0x7f3158013288, alter_info=0x7f31ac0c8c30, order_num=0, order=0x0, ignore=false) at /data/src/10.4/sql/sql_table.cc:10119
      #21 0x000055a94fa0a341 in Sql_cmd_alter_table::execute (this=0x7f3158013a70, thd=0x7f3158000af0) at /data/src/10.4/sql/sql_alter.cc:508
      #22 0x000055a94f888d95 in mysql_execute_command (thd=0x7f3158000af0) at /data/src/10.4/sql/sql_parse.cc:6102
      #23 0x000055a94f88e457 in mysql_parse (thd=0x7f3158000af0, rawbuf=0x7f3158013198 "ALTER TABLE t1 MODIFY b INT FIRST", length=33, parser_state=0x7f31ac0ca160, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:7901
      #24 0x000055a94f8795fc in dispatch_command (command=COM_QUERY, thd=0x7f3158000af0, packet=0x7f3158137511 "ALTER TABLE t1 MODIFY b INT FIRST", packet_length=33, is_com_multi=false, is_next_command=false) at /data/src/10.4/sql/sql_parse.cc:1842
      #25 0x000055a94f877c89 in do_command (thd=0x7f3158000af0) at /data/src/10.4/sql/sql_parse.cc:1360
      #26 0x000055a94fa00c51 in do_handle_one_connection (connect=0x55a9535fd880) at /data/src/10.4/sql/sql_connect.cc:1412
      #27 0x000055a94fa009a0 in handle_one_connection (arg=0x55a9535fd880) at /data/src/10.4/sql/sql_connect.cc:1316
      #28 0x000055a950406b0d in pfs_spawn_thread (arg=0x55a953569f50) at /data/src/10.4/storage/perfschema/pfs.cc:1862
      #29 0x00007f31b2cf44a4 in start_thread (arg=0x7f31ac0cb700) at pthread_create.c:456
      #30 0x00007f31b0e28d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97
      

      No obvious effect on a non-debug build.
      Not reproducible on 10.3.
      Not reproducible on 10.5, probably because the failure is fairly new (I didn't bisect for the exact revision, though).

      Attachments

        Issue Links

          Activity

            I can repeat the failure on 10.5:

            10.5 cc3135cf83c07971665cd0c2225c40b74c5d2778

            mysqld: /mariadb/10.5/storage/innobase/include/dict0dict.ic:817: dict_field_t *dict_index_get_nth_field(const dict_index_t *, ulint): Assertion `pos < index->n_def' failed.
            …
            #7  0x000055c99830e149 in dict_index_get_nth_field (index=0x7f7d5411cdb8, pos=4) at /mariadb/10.5/storage/innobase/include/dict0dict.ic:817
            #8  0x000055c998315730 in rec_get_converted_size_comp_prefix_low<true> (index=0x7f7d5411cdb8, dfield=0x7f7d5417c228, n_fields=5, extra=0x0, status=REC_STATUS_INSTANT, temp=false) at /mariadb/10.5/storage/innobase/rem/rem0rec.cc:1163
            #9  0x000055c998314e78 in rec_get_converted_size_comp (index=0x7f7d5411cdb8, tuple=0x7f7d5417c168, extra=0x0) at /mariadb/10.5/storage/innobase/rem/rem0rec.cc:1295
            #10 0x000055c9985822fb in rec_get_converted_size (index=0x7f7d5411cdb8, dtuple=0x7f7d5417c168, n_ext=0) at /mariadb/10.5/storage/innobase/include/rem0rec.ic:1388
            #11 0x000055c998580ce1 in dtuple_convert_big_rec (index=0x7f7d5411cdb8, upd=0x0, entry=0x7f7d5417c168, n_ext=0x7f7d801f7bd8) at /mariadb/10.5/storage/innobase/data/data0data.cc:621
            #12 0x000055c9984dc13b in btr_cur_optimistic_insert (flags=2, cursor=0x7f7d801f80d8, offsets=0x7f7d801f7e48, heap=0x7f7d801f80b0, entry=0x7f7d5417c168, rec=0x7f7d801f7de0, big_rec=0x7f7d801f80c0, n_ext=0, thr=0x7f7d5417c2f0, mtr=0x7f7d801f8200) at /mariadb/10.5/storage/innobase/btr/btr0cur.cc:3398
            #13 0x000055c99834680d in row_ins_clust_index_entry_low (flags=2, mode=33, index=0x7f7d5411cdb8, n_uniq=2, entry=0x7f7d5417c168, n_ext=0, thr=0x7f7d5417c2f0) at /mariadb/10.5/storage/innobase/row/row0ins.cc:2773
            #14 0x000055c9981e5541 in innobase_instant_try (ha_alter_info=0x7f7d801fc098, ctx=0x7f7d54013f58, altered_table=0x7f7d801fc408, table=0x7f7d5412e9f8, trx=0x7f7d8149c268) at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:5826
            #15 0x000055c9981ef0f5 in commit_try_norebuild (ha_alter_info=0x7f7d801fc098, ctx=0x7f7d54013f58, altered_table=0x7f7d801fc408, old_table=0x7f7d5412e9f8, trx=0x7f7d8149c268, table_name=0x7f7d5411cd15 "t1") at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:10097
            #16 0x000055c9981d187f in ha_innobase::commit_inplace_alter_table (this=0x7f7d5412f800, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, commit=true) at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:10809
            #17 0x000055c997d61a5e in handler::ha_commit_inplace_alter_table (this=0x7f7d5412f800, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, commit=true) at /mariadb/10.5/sql/handler.cc:4558
            #18 0x000055c997abc0f6 in mysql_inplace_alter_table (thd=0x7f7d54000cf8, table_list=0x7f7d54012810, table=0x7f7d5412e9f8, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, inplace_supported=HA_ALTER_INPLACE_INSTANT, target_mdl_request=0x7f7d801fd7b0, alter_ctx=0x7f7d801fd960) at /mariadb/10.5/sql/sql_table.cc:7785
            #19 0x000055c997ab49be in mysql_alter_table (thd=0x7f7d54000cf8, new_db=0x7f7d540054d8, new_name=0x7f7d540058e0, create_info=0x7f7d801fece8, table_list=0x7f7d54012810, alter_info=0x7f7d801fec30, order_num=0, order=0x0, ignore=false) at /mariadb/10.5/sql/sql_table.cc:10129
            #20 0x000055c997b7a84e in Sql_cmd_alter_table::execute (this=0x7f7d54012fe8, thd=0x7f7d54000cf8) at /mariadb/10.5/sql/sql_alter.cc:517
            #21 0x000055c9979a766a in mysql_execute_command (thd=0x7f7d54000cf8) at /mariadb/10.5/sql/sql_parse.cc:5959
            #22 0x000055c997992430 in mysql_parse (thd=0x7f7d54000cf8, rawbuf=0x7f7d54012720 "ALTER TABLE t1 MODIFY b INT FIRST", length=33, parser_state=0x7f7d80200cc8, is_com_multi=false, is_next_command=false) at /mariadb/10.5/sql/sql_parse.cc:7988
            

            marko Marko Mäkelä added a comment - I can repeat the failure on 10.5: 10.5 cc3135cf83c07971665cd0c2225c40b74c5d2778 mysqld: /mariadb/10.5/storage/innobase/include/dict0dict.ic:817: dict_field_t *dict_index_get_nth_field(const dict_index_t *, ulint): Assertion `pos < index->n_def' failed. … #7 0x000055c99830e149 in dict_index_get_nth_field (index=0x7f7d5411cdb8, pos=4) at /mariadb/10.5/storage/innobase/include/dict0dict.ic:817 #8 0x000055c998315730 in rec_get_converted_size_comp_prefix_low<true> (index=0x7f7d5411cdb8, dfield=0x7f7d5417c228, n_fields=5, extra=0x0, status=REC_STATUS_INSTANT, temp=false) at /mariadb/10.5/storage/innobase/rem/rem0rec.cc:1163 #9 0x000055c998314e78 in rec_get_converted_size_comp (index=0x7f7d5411cdb8, tuple=0x7f7d5417c168, extra=0x0) at /mariadb/10.5/storage/innobase/rem/rem0rec.cc:1295 #10 0x000055c9985822fb in rec_get_converted_size (index=0x7f7d5411cdb8, dtuple=0x7f7d5417c168, n_ext=0) at /mariadb/10.5/storage/innobase/include/rem0rec.ic:1388 #11 0x000055c998580ce1 in dtuple_convert_big_rec (index=0x7f7d5411cdb8, upd=0x0, entry=0x7f7d5417c168, n_ext=0x7f7d801f7bd8) at /mariadb/10.5/storage/innobase/data/data0data.cc:621 #12 0x000055c9984dc13b in btr_cur_optimistic_insert (flags=2, cursor=0x7f7d801f80d8, offsets=0x7f7d801f7e48, heap=0x7f7d801f80b0, entry=0x7f7d5417c168, rec=0x7f7d801f7de0, big_rec=0x7f7d801f80c0, n_ext=0, thr=0x7f7d5417c2f0, mtr=0x7f7d801f8200) at /mariadb/10.5/storage/innobase/btr/btr0cur.cc:3398 #13 0x000055c99834680d in row_ins_clust_index_entry_low (flags=2, mode=33, index=0x7f7d5411cdb8, n_uniq=2, entry=0x7f7d5417c168, n_ext=0, thr=0x7f7d5417c2f0) at /mariadb/10.5/storage/innobase/row/row0ins.cc:2773 #14 0x000055c9981e5541 in innobase_instant_try (ha_alter_info=0x7f7d801fc098, ctx=0x7f7d54013f58, altered_table=0x7f7d801fc408, table=0x7f7d5412e9f8, trx=0x7f7d8149c268) at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:5826 #15 0x000055c9981ef0f5 in commit_try_norebuild (ha_alter_info=0x7f7d801fc098, ctx=0x7f7d54013f58, altered_table=0x7f7d801fc408, old_table=0x7f7d5412e9f8, trx=0x7f7d8149c268, table_name=0x7f7d5411cd15 "t1") at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:10097 #16 0x000055c9981d187f in ha_innobase::commit_inplace_alter_table (this=0x7f7d5412f800, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, commit=true) at /mariadb/10.5/storage/innobase/handler/handler0alter.cc:10809 #17 0x000055c997d61a5e in handler::ha_commit_inplace_alter_table (this=0x7f7d5412f800, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, commit=true) at /mariadb/10.5/sql/handler.cc:4558 #18 0x000055c997abc0f6 in mysql_inplace_alter_table (thd=0x7f7d54000cf8, table_list=0x7f7d54012810, table=0x7f7d5412e9f8, altered_table=0x7f7d801fc408, ha_alter_info=0x7f7d801fc098, inplace_supported=HA_ALTER_INPLACE_INSTANT, target_mdl_request=0x7f7d801fd7b0, alter_ctx=0x7f7d801fd960) at /mariadb/10.5/sql/sql_table.cc:7785 #19 0x000055c997ab49be in mysql_alter_table (thd=0x7f7d54000cf8, new_db=0x7f7d540054d8, new_name=0x7f7d540058e0, create_info=0x7f7d801fece8, table_list=0x7f7d54012810, alter_info=0x7f7d801fec30, order_num=0, order=0x0, ignore=false) at /mariadb/10.5/sql/sql_table.cc:10129 #20 0x000055c997b7a84e in Sql_cmd_alter_table::execute (this=0x7f7d54012fe8, thd=0x7f7d54000cf8) at /mariadb/10.5/sql/sql_alter.cc:517 #21 0x000055c9979a766a in mysql_execute_command (thd=0x7f7d54000cf8) at /mariadb/10.5/sql/sql_parse.cc:5959 #22 0x000055c997992430 in mysql_parse (thd=0x7f7d54000cf8, rawbuf=0x7f7d54012720 "ALTER TABLE t1 MODIFY b INT FIRST", length=33, parser_state=0x7f7d80200cc8, is_com_multi=false, is_next_command=false) at /mariadb/10.5/sql/sql_parse.cc:7988

            The ‘problem’ is that the PRIMARY KEY columns are the only user-specified columns in the table. I believe that could have been always broken in 10.4, and should have been on 10.5 as well.

            The following fixed the test case for me on 10.5. I will test 10.4 as well.

            diff --git a/storage/innobase/rem/rem0rec.cc b/storage/innobase/rem/rem0rec.cc
            index 1bdd8c75ce1..613dd2d6a81 100644
            --- a/storage/innobase/rem/rem0rec.cc
            +++ b/storage/innobase/rem/rem0rec.cc
            @@ -1,7 +1,7 @@
             /*****************************************************************************
             
             Copyright (c) 1994, 2016, Oracle and/or its affiliates. All Rights Reserved.
            -Copyright (c) 2017, 2019, MariaDB Corporation.
            +Copyright (c) 2017, 2020, MariaDB Corporation.
             
             This program is free software; you can redistribute it and/or modify it under
             the terms of the GNU General Public License as published by the Free Software
            @@ -1155,7 +1155,10 @@ rec_get_converted_size_comp_prefix_low(
             	for (ulint i = 0; dfield < end; i++, dfield++) {
             		if (mblob && i == index->first_user_field()) {
             			data_size += FIELD_REF_SIZE;
            -			++dfield;
            +			if (++dfield == end) {
            +				ut_ad(i == index->n_fields);
            +				break;
            +			}
             		}
             
             		ulint len = dfield_get_len(dfield);
            @@ -1597,7 +1600,11 @@ rec_convert_dtuple_to_rec_comp(
             				ut_ad(dfield_is_ext(field));
             				memcpy(end, dfield_get_data(field), len);
             				end += len;
            -				len = dfield_get_len(++field);
            +				if (++field == fend) {
            +					ut_ad(i == index->n_fields);
            +					break;
            +				}
            +				len = dfield_get_len(field);
             			}
             		} else if (UNIV_UNLIKELY(i == n_node_ptr_field)) {
             			ut_ad(field->type.prtype & DATA_NOT_NULL);
            

            marko Marko Mäkelä added a comment - The ‘problem’ is that the PRIMARY KEY columns are the only user-specified columns in the table. I believe that could have been always broken in 10.4, and should have been on 10.5 as well. The following fixed the test case for me on 10.5. I will test 10.4 as well. diff --git a/storage/innobase/rem/rem0rec.cc b/storage/innobase/rem/rem0rec.cc index 1bdd8c75ce1..613dd2d6a81 100644 --- a/storage/innobase/rem/rem0rec.cc +++ b/storage/innobase/rem/rem0rec.cc @@ -1,7 +1,7 @@ /***************************************************************************** Copyright (c) 1994, 2016, Oracle and/or its affiliates. All Rights Reserved. -Copyright (c) 2017, 2019, MariaDB Corporation. +Copyright (c) 2017, 2020, MariaDB Corporation. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software @@ -1155,7 +1155,10 @@ rec_get_converted_size_comp_prefix_low( for (ulint i = 0; dfield < end; i++, dfield++) { if (mblob && i == index->first_user_field()) { data_size += FIELD_REF_SIZE; - ++dfield; + if (++dfield == end) { + ut_ad(i == index->n_fields); + break; + } } ulint len = dfield_get_len(dfield); @@ -1597,7 +1600,11 @@ rec_convert_dtuple_to_rec_comp( ut_ad(dfield_is_ext(field)); memcpy(end, dfield_get_data(field), len); end += len; - len = dfield_get_len(++field); + if (++field == fend) { + ut_ad(i == index->n_fields); + break; + } + len = dfield_get_len(field); } } else if (UNIV_UNLIKELY(i == n_node_ptr_field)) { ut_ad(field->type.prtype & DATA_NOT_NULL);

            People

              marko Marko Mäkelä
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.