Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-21645

SEGV in innobase_get_computed_value

Details

    Description

      --source include/have_innodb.inc
      		 
       
      		 
      SET SESSION sql_mode = 'NO_ENGINE_SUBSTITUTION' ;
      		 
      # No SEGV with Compressed
      		 
      # CREATE TABLE t1 ( col1 INT PRIMARY KEY, col_text TEXT, col1_g INTEGER GENERATED ALWAYS AS (col1) ) ENGINE = InnoDB ROW_FORMAT = Compressed ;
      		 
      # but with Redundant , Dynamic and Compact.
      		 
      CREATE TABLE t1 ( col1 INT PRIMARY KEY, col_text TEXT, col1_g INTEGER GENERATED ALWAYS AS (col1) ) ENGINE = InnoDB ROW_FORMAT = Dynamic ;
      		 
      ALTER TABLE t1 MODIFY COLUMN col_text TEXT FIRST ;
      		 
      INSERT INTO t1 (col1, col_text ) VALUES ( 1475, 'AAA' );
      		 
      ALTER TABLE t1 ADD UNIQUE INDEX ( col1_g ) ;
      		 
       
      		 
      DROP TABLE t1;
      		 
       
      		 
      Version: '10.4.13-MariaDB-debug-log'  socket: '/home/mleich/Server/10.4/bld_debug/mysql-test/var/tmp/mysqld.1.sock'  port: 16000  Source distribution
      		 
      200203 17:44:42 [ERROR] mysqld got signal 11 ;
      		 
      ...
      		 
      Query (0x7fca2c012660): ALTER TABLE t1 ADD UNIQUE INDEX ( col1_g )
      		 
      Connection ID (thread ID): 9
      		 
      Status: NOT_KILLED

      Thread 1 (Thread 0x7fca81d34700 (LWP 13861)):
      #0 __pthread_kill (threadid=<optimized out>, signo=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      #1 0x00005562d040f5b9 in my_write_core (sig=11) at /home/mleich/Server/10.4/mysys/stacktrace.c:481
      #2 0x00005562cfab7d27 in handle_fatal_signal (sig=11) at /home/mleich/Server/10.4/sql/signal_handler.cc:343
      #3 <signal handler called>
      #4 0x00005562cfd24039 in innobase_get_computed_value (row=0x7fca2c060d98, col=0x7fca2c17af00, index=0x7fca2c043198, local_heap=0x7fca81d2de58, heap=0x0, ifield=0x7fca2c0604f0, thd=0x7fca2c000cd8, mysql_table=0x7fca81d2f800, mysql_rec=0x7fca2c070e08 '\217' <repeats 24 times>, old_table=0x7fca2c17a898, parent_update=0x0, foreign=0x0) at /home/mleich/Server/10.4/storage/innobase/handler/ha_innodb.cc:20887
      #5 0x00005562cfe94103 in row_merge_buf_add (buf=0x7fca2c19a668, fts_index=0x0, old_table=0x7fca2c17a898, new_table=0x7fca2c17a898, psort_info=0x0, row=0x7fca2c060d98, ext=0x0, doc_id=0x7fca81d2de60, conv_heap=0x0, err=0x7fca81d2de4c, v_heap=0x7fca81d2de58, my_table=0x7fca81d2f800, trx=0x7fca827ca140) at /home/mleich/Server/10.4/storage/innobase/row/row0merge.cc:601
      #6 0x00005562cfe9b7e4 in row_merge_read_clustered_index (trx=0x7fca827ca140, table=0x7fca81d2f800, old_table=0x7fca2c17a898, new_table=0x7fca2c17a898, online=true, index=0x7fca2c05f2a8, fts_sort_idx=0x0, psort_info=0x0, files=0x7fca2c060cc0, key_numbers=0x7fca2c05f2b0, n_index=1, defaults=0x0, add_v=0x0, col_map=0x0, add_autoinc=18446744073709551615, sequence=..., block=0x7fca784f9000 <error: Cannot access memory at address 0x7fca784f9000>, skip_pk_sort=false, tmpfd=0x7fca81d2eab0, stage=0x7fca2c05fca0, pct_cost=50, crypt_block=0x0, eval_table=0x7fca81d2f800, allow_not_null=true) at /home/mleich/Server/10.4/storage/innobase/row/row0merge.cc:2364
      #7 0x00005562cfea2f77 in row_merge_build_indexes (trx=0x7fca827ca140, old_table=0x7fca2c17a898, new_table=0x7fca2c17a898, online=true, indexes=0x7fca2c05f2a8, key_numbers=0x7fca2c05f2b0, n_indexes=1, table=0x7fca81d2f800, defaults=0x0, col_map=0x0, add_autoinc=18446744073709551615, sequence=..., skip_pk_sort=false, stage=0x7fca2c05fca0, add_v=0x0, eval_table=0x7fca81d2f800, allow_not_null=true) at /home/mleich/Server/10.4/storage/innobase/row/row0merge.cc:4704
      #8 0x00005562cfd5596e in ha_innobase::inplace_alter_table (this=0x7fca2c149f70, altered_table=0x7fca81d2f800, ha_alter_info=0x7fca81d2f770) at /home/mleich/Server/10.4/storage/innobase/handler/handler0alter.cc:8363
      #9 0x00005562cf854149 in handler::ha_inplace_alter_table (this=0x7fca2c149f70, altered_table=0x7fca81d2f800, ha_alter_info=0x7fca81d2f770) at /home/mleich/Server/10.4/sql/handler.h:4361
      #10 0x00005562cf84825f in mysql_inplace_alter_table (thd=0x7fca2c000cd8, table_list=0x7fca2c012768, table=0x7fca2c149178, altered_table=0x7fca81d2f800, ha_alter_info=0x7fca81d2f770, inplace_supported=HA_ALTER_INPLACE_NOCOPY_NO_LOCK, target_mdl_request=0x7fca81d305d0, alter_ctx=0x7fca81d31100) at /home/mleich/Server/10.4/sql/sql_table.cc:7725
      #11 0x00005562cf84f0de in mysql_alter_table (thd=0x7fca2c000cd8, new_db=0x7fca2c005498, new_name=0x7fca2c0058a0, create_info=0x7fca81d31ce0, table_list=0x7fca2c012768, alter_info=0x7fca81d31c20, order_num=0, order=0x0, ignore=false) at /home/mleich/Server/10.4/sql/sql_table.cc:10119
      #12 0x00005562cf8e6fc8 in Sql_cmd_alter_table::execute (this=0x7fca2c012ef8, thd=0x7fca2c000cd8) at /home/mleich/Server/10.4/sql/sql_alter.cc:502
      #13 0x00005562cf765d63 in mysql_execute_command (thd=0x7fca2c000cd8) at /home/mleich/Server/10.4/sql/sql_parse.cc:6102
      #14 0x00005562cf76b417 in mysql_parse (thd=0x7fca2c000cd8, rawbuf=0x7fca2c012660 "ALTER TABLE t1 ADD UNIQUE INDEX ( col1_g )", length=42, parser_state=0x7fca81d33150, is_com_multi=false, is_next_command=false) at /home/mleich/Server/10.4/sql/sql_parse.cc:7901
      #15 0x00005562cf7565e9 in dispatch_command (command=COM_QUERY, thd=0x7fca2c000cd8, packet=0x7fca2c008199 "ALTER TABLE t1 ADD UNIQUE INDEX ( col1_g ) ", packet_length=43, is_com_multi=false, is_next_command=false) at /home/mleich/Server/10.4/sql/sql_parse.cc:1841
      #16 0x00005562cf754c75 in do_command (thd=0x7fca2c000cd8) at /home/mleich/Server/10.4/sql/sql_parse.cc:1359
      #17 0x00005562cf8dd8e7 in do_handle_one_connection (connect=0x5562d24d2a08) at /home/mleich/Server/10.4/sql/sql_connect.cc:1412
      #18 0x00005562cf8dd636 in handle_one_connection (arg=0x5562d24d2a08) at /home/mleich/Server/10.4/sql/sql_connect.cc:1316
      #19 0x00005562d02e2c1e in pfs_spawn_thread (arg=0x5562d23dc4f8) at /home/mleich/Server/10.4/storage/perfschema/pfs.cc:1869
      #20 0x00007fca8983b7fc in start_thread (arg=0x7fca81d34700) at pthread_create.c:465
      #21 0x00007fca88a71b5f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Replay - 10.4.13 commit d87b725eebbddb6d319ee99e51924a62635185a1 (debug build)
      Replay - 10.5.1 commit 287c1db7867502348dcbc9ff7ccaae3d289cdbb1 (debug build)
      Replay - 10.5.1 commit 287c1db7867502348dcbc9ff7ccaae3d289cdbb1 (non debug build)
      No replay - 10.3 commit b0fa30808622fe12d474a70af1838906e60b9897 (debug build)
      No replay - 10.2

      Attachments

        1. ml_weg3.test
          0.6 kB
        2. prt
          55 kB

        Issue Links

          is caused by

          Task - A task that needs to be done. MDEV-15562 Instant DROP COLUMN or changing the order of columns

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed
          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-23672 Assertion `v.v_indexes.empty()' failed in dict_table_t::instant_column

          • Major - Major loss of function.
          • Closed

          Activity

            marko Marko Mäkelä added a comment -

            The crash is due to templ=NULL in innobase_get_computed_value(). The arguments of the function invocation seem fine to me.
            Here is a slightly cleaner test case that should repeat the problem with older 10.4 versions, also before the MDEV-20117 fix:

            --source include/have_innodb.inc
            		 
            CREATE TABLE t1 (a INT PRIMARY KEY, b INT, va INTEGER GENERATED ALWAYS AS (a))
            		 
            ENGINE=InnoDB;
            		 
            INSERT INTO t1 SET a=1, b=NULL;
            		 
            ALTER TABLE t1 MODIFY COLUMN b INT FIRST;
            		 
            ALTER TABLE t1 ADD UNIQUE INDEX (va);
            		 
            DROP TABLE t1;

            We might be missing a reload of the table definition when virtual columns exist. That reload should ultimately be removed in MDEV-17468, but for now we have it in ha_innobase::commit_inplace_alter_table():

            	/* MDEV-17468: Avoid this at least when ctx->is_instant().
            		 
            	Currently dict_load_column_low() is the only place where
            		 
            	num_base for virtual columns is assigned to nonzero. */
            		 
            	if (ctx0->num_to_drop_vcol || ctx0->num_to_add_vcol) {
            		 
            		DBUG_ASSERT(ctx0->old_table->get_ref_count() == 1);

            If we enable this handling also for chanigng the order of columns, the crash should be avoided.

            marko Marko Mäkelä added a comment - The crash is due to templ=NULL in innobase_get_computed_value() . The arguments of the function invocation seem fine to me. Here is a slightly cleaner test case that should repeat the problem with older 10.4 versions, also before the MDEV-20117 fix: --source include/have_innodb.inc CREATE TABLE t1 (a INT PRIMARY KEY , b INT , va INTEGER GENERATED ALWAYS AS (a)) ENGINE=InnoDB; INSERT INTO t1 SET a=1, b= NULL ; ALTER TABLE t1 MODIFY COLUMN b INT FIRST ; ALTER TABLE t1 ADD UNIQUE INDEX (va); DROP TABLE t1; We might be missing a reload of the table definition when virtual columns exist. That reload should ultimately be removed in MDEV-17468 , but for now we have it in ha_innobase::commit_inplace_alter_table() : /* MDEV-17468: Avoid this at least when ctx->is_instant(). Currently dict_load_column_low() is the only place where num_base for virtual columns is assigned to nonzero. */ if (ctx0->num_to_drop_vcol || ctx0->num_to_add_vcol) { DBUG_ASSERT(ctx0->old_table->get_ref_count() == 1); If we enable this handling also for chanigng the order of columns, the crash should be avoided.

            People

              marko Marko Mäkelä
              mleich Matthias Leich
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.