Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22317

SIGSEGV in my_free/delete_dynamic in optimized builds (ARIA)

Details

    Description

      USE test;
      CREATE TABLE t(c int) ENGINE=Aria;
      SET @@SESSION.default_master_connection='0';
      CHANGE MASTER TO master_use_gtid=slave_pos;
      SET @@GLOBAL.replicate_wild_ignore_table='';
      

      Leads to:

      10.5.3 181f17c3cd4366f58d9efbff9d7556bb49742ed4

      Core was generated by `/test/MD180420-mariadb-10.5.3-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      [Current thread is 1 (Thread 0x7f31b996c700 (LWP 19532))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      #1  0x000055e2e4266e87 in my_write_core (sig=sig@entry=11) at /test/10.5_opt/mysys/stacktrace.c:518
      #2  0x000055e2e3c292ca in handle_fatal_signal (sig=11) at /test/10.5_opt/sql/signal_handler.cc:329
      #3  <signal handler called>
      #4  my_free (ptr=0x200000) at /test/10.5_opt/mysys/my_malloc.c:196
      #5  0x000055e2e423cc3f in delete_dynamic (array=array@entry=0x7f318ac912c8) at /test/10.5_opt/mysys/array.c:305
      #6  0x000055e2e397ff77 in Rpl_filter::set_wild_ignore_table (this=this@entry=0x7f318ac911c0, table_spec=table_spec@entry=0x7f318ac47208 "") at /test/10.5_opt/sql/rpl_filter.cc:441
      #7  0x000055e2e3b3676b in Sys_var_rpl_filter::set_filter_value (this=this@entry=0x55e2e4ddb0a0 <Sys_replicate_wild_ignore_table>, value=0x7f318ac47208 "", mi=mi@entry=0x7f318ac98000) at /test/10.5_opt/sql/sys_vars.cc:5254
      #8  0x000055e2e3b36813 in Sys_var_rpl_filter::global_update (this=0x55e2e4ddb0a0 <Sys_replicate_wild_ignore_table>, thd=<optimized out>, var=0x7f318ac471b8) at /test/10.5_opt/sql/sys_vars.cc:5221
      #9  0x000055e2e398315f in sys_var::update (this=0x55e2e4ddb0a0 <Sys_replicate_wild_ignore_table>, thd=0x7f318ac12018, var=0x7f318ac471b8) at /test/10.5_opt/sql/set_var.cc:207
      #10 0x000055e2e3983637 in set_var::update (this=<optimized out>, thd=<optimized out>) at /test/10.5_opt/sql/set_var.cc:859
      #11 0x000055e2e3984949 in sql_set_variables (thd=thd@entry=0x7f318ac12018, var_list=var_list@entry=0x7f318ac16d70, free=free@entry=true) at /test/10.5_opt/sql/set_var.cc:746
      #12 0x000055e2e3a354d1 in mysql_execute_command (thd=thd@entry=0x7f318ac12018) at /test/10.5_opt/sql/sql_parse.cc:4976
      #13 0x000055e2e3a3ab9c in mysql_parse (thd=thd@entry=0x7f318ac12018, rawbuf=<optimized out>, length=43, parser_state=parser_state@entry=0x7f31b996b4d0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:7953
      #14 0x000055e2e3a2fa10 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f318ac12018, packet=packet@entry=0x7f318ac3a019 "SET @@GLOBAL.replicate_wild_ignore_table=''", packet_length=packet_length@entry=43, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1839
      #15 0x000055e2e3a2dd2f in do_command (thd=0x7f318ac12018) at /test/10.5_opt/sql/sql_parse.cc:1358
      #16 0x000055e2e3b22d7e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7f31b74329b8, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1422
      #17 0x000055e2e3b22f24 in handle_one_connection (arg=arg@entry=0x7f31b74329b8) at /test/10.5_opt/sql/sql_connect.cc:1319
      #18 0x000055e2e3e8f52a in pfs_spawn_thread (arg=0x7f31b744b018) at /test/10.5_opt/storage/perfschema/pfs.cc:2201
      #19 0x00007f31b8d936db in start_thread (arg=0x7f31b996c700) at pthread_create.c:463
      #20 0x00007f31b819188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.5.2 (opt), 10.5.3 (opt)

      Bug confirmed not present in:
      MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt), 10.5.2 (dbg), 10.5.3 (dbg)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

      Attachments

        Issue Links

          Activity

            The above test scenario along with valgrind provides following details.

            Problem exists for 'wild_do_table' and 'wild_ignore_table' options.

            1. Wild_ignore_table:

            ==19870== Thread 16:
            ==19870== Conditional jump or move depends on uninitialised value(s)
            ==19870==    at 0x74F451: Rpl_filter::set_wild_ignore_table(char const*) (rpl_filter.cc:439)
            ==19870==    by 0x8F04DA: Sys_var_rpl_filter::set_filter_value(char const*, Master_info*) (sys_vars.cc:5254)
            ==19870==    by 0x8F0583: Sys_var_rpl_filter::global_update(THD*, set_var*) (sys_vars.cc:5221)
            ==19870==    by 0x752186: sys_var::update(THD*, set_var*) (set_var.cc:207)
            ==19870==    by 0x752646: set_var::update(THD*) (set_var.cc:859)
            ==19870==    by 0x7539C8: sql_set_variables(THD*, List<set_var_base>*, bool) (set_var.cc:746)
            ==19870==    by 0x7F7D68: mysql_execute_command(THD*) (sql_parse.cc:4976)
            ==19870==    by 0x7FEEDA: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7957)
            ==19870==    by 0x7F3F14: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1839)
            ==19870==    by 0x7F2332: do_command(THD*) (sql_parse.cc:1358)
            ==19870==    by 0x8DD26B: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1422)
            ==19870==    by 0x8DD442: handle_one_connection (sql_connect.cc:1319)
            ==19870==    by 0xC0EC2D: pfs_spawn_thread (pfs.cc:2201)
            ==19870==    by 0x58D16DA: start_thread (pthread_create.c:463)
            ==19870==    by 0x67A488E: clone (clone.S:95)
            

            2. wild_do_table:

            ==18765== Conditional jump or move depends on uninitialised value(s)
            ==18765==    at 0xF60390: delete_dynamic (array.c:304)
            ==18765==    by 0x74F3F2: Rpl_filter::set_wild_do_table(char const*) (rpl_filter.cc:421)
            ==18765==    by 0x8F04CA: Sys_var_rpl_filter::set_filter_value(char const*, Master_info*) (sys_vars.cc:5251)
            ==18765==    by 0x8F0593: Sys_var_rpl_filter::global_update(THD*, set_var*) (sys_vars.cc:5221)
            ==18765==    by 0x752196: sys_var::update(THD*, set_var*) (set_var.cc:207)
            ==18765==    by 0x752656: set_var::update(THD*) (set_var.cc:859)
            ==18765==    by 0x7539D8: sql_set_variables(THD*, List<set_var_base>*, bool) (set_var.cc:746)
            ==18765==    by 0x7F7D78: mysql_execute_command(THD*) (sql_parse.cc:4976)
            ==18765==    by 0x7FEEEA: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7957)
            ==18765==    by 0x7F3F24: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1839)
            ==18765==    by 0x7F2342: do_command(THD*) (sql_parse.cc:1358)
            ==18765==    by 0x8DD27B: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1422)
            ==18765==    by 0x8DD452: handle_one_connection (sql_connect.cc:1319)
            ==18765==    by 0xC0EC3D: pfs_spawn_thread (pfs.cc:2201)
            ==18765==    by 0x58D16DA: start_thread (pthread_create.c:463)
            ==18765==    by 0x67A488E: clone (clone.S:95)
            ^ Found warnings in /home/sujatha/bug_repo/MDEV-22317-10.5/bld/mysql-test/var/log/mysqld.1.err
            

            sujatha.sivakumar Sujatha Sivakumar (Inactive) added a comment - The above test scenario along with valgrind provides following details. Problem exists for 'wild_do_table' and 'wild_ignore_table' options. 1. Wild_ignore_table: ==19870== Thread 16: ==19870== Conditional jump or move depends on uninitialised value(s) ==19870== at 0x74F451: Rpl_filter::set_wild_ignore_table(char const*) (rpl_filter.cc:439) ==19870== by 0x8F04DA: Sys_var_rpl_filter::set_filter_value(char const*, Master_info*) (sys_vars.cc:5254) ==19870== by 0x8F0583: Sys_var_rpl_filter::global_update(THD*, set_var*) (sys_vars.cc:5221) ==19870== by 0x752186: sys_var::update(THD*, set_var*) (set_var.cc:207) ==19870== by 0x752646: set_var::update(THD*) (set_var.cc:859) ==19870== by 0x7539C8: sql_set_variables(THD*, List<set_var_base>*, bool) (set_var.cc:746) ==19870== by 0x7F7D68: mysql_execute_command(THD*) (sql_parse.cc:4976) ==19870== by 0x7FEEDA: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7957) ==19870== by 0x7F3F14: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1839) ==19870== by 0x7F2332: do_command(THD*) (sql_parse.cc:1358) ==19870== by 0x8DD26B: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1422) ==19870== by 0x8DD442: handle_one_connection (sql_connect.cc:1319) ==19870== by 0xC0EC2D: pfs_spawn_thread (pfs.cc:2201) ==19870== by 0x58D16DA: start_thread (pthread_create.c:463) ==19870== by 0x67A488E: clone (clone.S:95) 2. wild_do_table: ==18765== Conditional jump or move depends on uninitialised value(s) ==18765== at 0xF60390: delete_dynamic (array.c:304) ==18765== by 0x74F3F2: Rpl_filter::set_wild_do_table(char const*) (rpl_filter.cc:421) ==18765== by 0x8F04CA: Sys_var_rpl_filter::set_filter_value(char const*, Master_info*) (sys_vars.cc:5251) ==18765== by 0x8F0593: Sys_var_rpl_filter::global_update(THD*, set_var*) (sys_vars.cc:5221) ==18765== by 0x752196: sys_var::update(THD*, set_var*) (set_var.cc:207) ==18765== by 0x752656: set_var::update(THD*) (set_var.cc:859) ==18765== by 0x7539D8: sql_set_variables(THD*, List<set_var_base>*, bool) (set_var.cc:746) ==18765== by 0x7F7D78: mysql_execute_command(THD*) (sql_parse.cc:4976) ==18765== by 0x7FEEEA: mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) (sql_parse.cc:7957) ==18765== by 0x7F3F24: dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) (sql_parse.cc:1839) ==18765== by 0x7F2342: do_command(THD*) (sql_parse.cc:1358) ==18765== by 0x8DD27B: do_handle_one_connection(CONNECT*, bool) (sql_connect.cc:1422) ==18765== by 0x8DD452: handle_one_connection (sql_connect.cc:1319) ==18765== by 0xC0EC3D: pfs_spawn_thread (pfs.cc:2201) ==18765== by 0x58D16DA: start_thread (pthread_create.c:463) ==18765== by 0x67A488E: clone (clone.S:95) ^ Found warnings in /home/sujatha/bug_repo/MDEV-22317-10.5/bld/mysql-test/var/log/mysqld.1.err
            sujatha.sivakumar Sujatha Sivakumar (Inactive) added a comment - Hello Andrei, Please review the fix for MDEV-22317 . https://github.com/MariaDB/server/commit/85b116d1ab9ea85dcef63d259b8f6366466e2750 BuildBot: http://buildbot.askmonty.org/buildbot/grid?category=main&branch=bb-10.5-sujatha Thank you.
            Elkin Andrei Elkin added a comment -

            One suggestion is done
            to address.

            Elkin Andrei Elkin added a comment - One suggestion is done to address.
            Elkin Andrei Elkin added a comment -

            Approved after mail exchange.

            Elkin Andrei Elkin added a comment - Approved after mail exchange.

            People

              sujatha.sivakumar Sujatha Sivakumar (Inactive)
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.