[MDEV-22445] Crash on HANDLER READ NEXT after XA PREPARE - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Critical
Resolution: Fixed
Affects Version/s: 10.1(EOL), 10.2(EOL), 10.3(EOL), 10.4(EOL), 10.5, 10.6, 10.7(EOL)
Fix Version/s: 10.2.41, 10.3.32, 10.4.22, 10.5.13, 10.6.5
Component/s: Storage Engine - InnoDB, XA
Labels:
- affects-tests
- upstream-5.5

Description

USE test;

CREATE TABLE t (a INT KEY) ENGINE=InnoDB;

HANDLER t OPEN AS t;

XA START '0';

SELECT * FROM t;

XA END '0';

XA PREPARE '0';

HANDLER t READ NEXT;

Leads to:

2020-05-04 06:53:45 0x7f1e288ff700  InnoDB: Assertion failure in file /test/10.5_opt/storage/innobase/trx/trx0trx.cc line 2250

10.5.3 f544a712c8a2ef3f3ecba80cb2782b1839fb36ab
Core was generated by `/test/MD010520-mariadb-10.5.3-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
[Current thread is 1 (Thread 0x7f408d89c700 (LWP 2429977))]
(gdb) bt
#0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
#1 0x000055a0aa642ac7 in my_write_core (sig=sig@entry=6) at /test/10.5_opt/mysys/stacktrace.c:518
#2 0x000055a0aa0047ca in handle_fatal_signal (sig=6) at /test/10.5_opt/sql/signal_handler.cc:329
#3 <signal handler called>
#4 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#5 0x00007f408bfe0801 in __GI_abort () at abort.c:79
#6 0x000055a0a9d0e61a in ut_dbg_assertion_failed (expr=expr@entry=0x0, file=file@entry=0x55a0aa96d4b8 "/test/10.5_opt/storage/innobase/trx/trx0trx.cc", line=line@entry=2250) at /test/10.5_opt/storage/innobase/ut/ut0dbg.cc:60
#7 0x000055a0aa475f0b in trx_start_if_not_started_xa_low (trx=0x7f4078002160, read_write=read_write@entry=false) at /test/10.5_opt/storage/innobase/trx/trx0trx.cc:2250
#8 0x000055a0aa31c63b in ha_innobase::init_table_handle_for_HANDLER (this=0x7f4059465830) at /test/10.5_opt/storage/innobase/handler/ha_innodb.cc:3270
#9 0x000055a0a9dd79a2 in mysql_ha_read (thd=thd@entry=0x7f4059412018, tables=tables@entry=0x7f40594471a0, mode=RFIRST, keyname=0x0, key_expr=0x0, ha_rkey_mode=HA_READ_KEY_EXACT, cond=0x0, select_limit_cnt=1, offset_limit_cnt=0) at /test/10.5_opt/sql/sql_handler.cc:877
#10 0x000055a0a9e10816 in mysql_execute_command (thd=thd@entry=0x7f4059412018) at /test/10.5_opt/sql/sql_parse.cc:5517
#11 0x000055a0a9e1622c in mysql_parse (thd=0x7f4059412018, rawbuf=<optimized out>, length=19, parser_state=0x7f408d89b4d0, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:7957
#12 0x000055a0a9e0b855 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f4059412018, packet=packet@entry=0x7f405943a019 "", packet_length=packet_length@entry=19, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_opt/sql/sql_parse.cc:1839
#13 0x000055a0a9e09ae6 in do_command (thd=0x7f4059412018) at /test/10.5_opt/sql/sql_parse.cc:1358
#14 0x000055a0a9efe29e in do_handle_one_connection (connect=<optimized out>, connect@entry=0x7f408b4329b8, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1422
#15 0x000055a0a9efe444 in handle_one_connection (arg=arg@entry=0x7f408b4329b8) at /test/10.5_opt/sql/sql_connect.cc:1319
#16 0x000055a0aa26a53a in pfs_spawn_thread (arg=0x7f408b44b018) at /test/10.5_opt/storage/perfschema/pfs.cc:2201
#17 0x00007f408ccc36db in start_thread (arg=0x7f408d89c700) at pthread_create.c:463
#18 0x00007f408c0c188f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Bug confirmed present in:
MariaDB: 10.1.45 (dbg), 10.1.45 (opt), 10.2.32 (dbg), 10.2.32 (opt), 10.3.23 (dbg), 10.3.23 (opt), 10.4.13 (dbg), 10.4.13 (opt), 10.5.2 (dbg), 10.5.2 (opt), 10.5.3 (dbg), 10.5.3 (opt)
MySQL: 5.5.62 (dbg)

Bug confirmed not present in:

MySQL: 5.5.62 (opt), 5.6.47 (dbg), 5.6.47 (opt), 5.7.29 (dbg), 5.7.29 (opt), 8.0.19 (dbg), 8.0.19 (opt)

Attachments

Issue Links

relates to

MDEV-742 LP:803649 - Xa recovery failed on client disconnection

Closed

MDEV-14846 InnoDB: assertion on trx->state because of deadlock error ignored

Closed

MDEV-30801 SIGABRT in trx_start_if_not_started_low on SELECT after XA

Open

Activity

Ascending order - Click to sort in descending order

View 5 older comments

Roel Van de Paar added a comment - 2021-05-04 06:10

It would seem that this can lead to data corruption?

Roel Van de Paar added a comment - 2021-05-04 06:10 It would seem that this can lead to data corruption?

Roel Van de Paar added a comment - 2021-09-17 20:52

Affects 10.7 also with same stack.

10.7.0 d552e092c9f3e20da078d1b62b976f629f73d3a4 (Debug)
Core was generated by `/test/MD180921-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x150a940c0700 (LWP 4340))]
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x0000150a97ea0859 in __GI_abort () at abort.c:79
#2 0x000055e80687785f in ut_dbg_assertion_failed (expr=expr@entry=0x0, file=file@entry=0x55e806edb7b0 "/test/10.7_dbg/storage/innobase/trx/trx0trx.cc", line=line@entry=2062) at /test/10.7_dbg/storage/innobase/ut/ut0dbg.cc:60
#3 0x000055e8068619e1 in trx_start_if_not_started_xa_low (trx=<optimized out>, read_write=read_write@entry=false) at /test/10.7_dbg/storage/innobase/trx/trx0trx.cc:2062
#4 0x000055e80661f075 in ha_innobase::init_table_handle_for_HANDLER (this=0x150a4c026f00) at /test/10.7_dbg/storage/innobase/handler/ha_innodb.cc:3590
#5 0x000055e805f3d1bd in mysql_ha_read (thd=thd@entry=0x150a4c000db8, tables=tables@entry=0x150a4c013db8, mode=RFIRST, keyname=0x0, key_expr=0xa5a5a5a5a5a5a5a5, ha_rkey_mode=HA_READ_KEY_EXACT, cond=0x0, select_limit_cnt=1, offset_limit_cnt=0) at /test/10.7_dbg/sql/sql_handler.cc:888
#6 0x000055e805f96f00 in mysql_execute_command (thd=thd@entry=0x150a4c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_limit.h:85
#7 0x000055e805f7ed4b in mysql_parse (thd=thd@entry=0x150a4c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150a940bf400) at /test/10.7_dbg/sql/sql_parse.cc:8028
#8 0x000055e805f8d944 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150a4c000db8, packet=packet@entry=0x150a4c00b729 "", packet_length=packet_length@entry=19, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1358
#9 0x000055e805f90d4a in do_command (thd=0x150a4c000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1402
#10 0x000055e806106ed8 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55e80a03a3e8, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1418
#11 0x000055e8061074dd in handle_one_connection (arg=arg@entry=0x55e80a03a3e8) at /test/10.7_dbg/sql/sql_connect.cc:1312
#12 0x000055e80657047e in pfs_spawn_thread (arg=0x55e809f392c8) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
#13 0x0000150a983af609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#14 0x0000150a97f9d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Roel Van de Paar added a comment - 2021-09-17 20:52 Affects 10.7 also with same stack. 10.7.0 d552e092c9f3e20da078d1b62b976f629f73d3a4 (Debug) Core was generated by `/test/MD180921-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 [Current thread is 1 (Thread 0x150a940c0700 (LWP 4340))] (gdb) bt #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 #1 0x0000150a97ea0859 in __GI_abort () at abort.c:79 #2 0x000055e80687785f in ut_dbg_assertion_failed (expr=expr@entry=0x0, file=file@entry=0x55e806edb7b0 "/test/10.7_dbg/storage/innobase/trx/trx0trx.cc", line=line@entry=2062) at /test/10.7_dbg/storage/innobase/ut/ut0dbg.cc:60 #3 0x000055e8068619e1 in trx_start_if_not_started_xa_low (trx=<optimized out>, read_write=read_write@entry=false) at /test/10.7_dbg/storage/innobase/trx/trx0trx.cc:2062 #4 0x000055e80661f075 in ha_innobase::init_table_handle_for_HANDLER (this=0x150a4c026f00) at /test/10.7_dbg/storage/innobase/handler/ha_innodb.cc:3590 #5 0x000055e805f3d1bd in mysql_ha_read (thd=thd@entry=0x150a4c000db8, tables=tables@entry=0x150a4c013db8, mode=RFIRST, keyname=0x0, key_expr=0xa5a5a5a5a5a5a5a5, ha_rkey_mode=HA_READ_KEY_EXACT, cond=0x0, select_limit_cnt=1, offset_limit_cnt=0) at /test/10.7_dbg/sql/sql_handler.cc:888 #6 0x000055e805f96f00 in mysql_execute_command (thd=thd@entry=0x150a4c000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_limit.h:85 #7 0x000055e805f7ed4b in mysql_parse (thd=thd@entry=0x150a4c000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x150a940bf400) at /test/10.7_dbg/sql/sql_parse.cc:8028 #8 0x000055e805f8d944 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150a4c000db8, packet=packet@entry=0x150a4c00b729 "", packet_length=packet_length@entry=19, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:1358 #9 0x000055e805f90d4a in do_command (thd=0x150a4c000db8, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1402 #10 0x000055e806106ed8 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55e80a03a3e8, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1418 #11 0x000055e8061074dd in handle_one_connection (arg=arg@entry=0x55e80a03a3e8) at /test/10.7_dbg/sql/sql_connect.cc:1312 #12 0x000055e80657047e in pfs_spawn_thread (arg=0x55e809f392c8) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201 #13 0x0000150a983af609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #14 0x0000150a97f9d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Nikita Malyavin added a comment - 2021-10-07 13:41

Right,
changing the last line as follows:

CREATE TABLE t (a INT KEY) ENGINE=InnoDB;

HANDLER t OPEN AS t;

XA START '0';

SELECT * FROM t;

XA END '0';

XA PREPARE '0';

SELECT * FROM t;

would lead to an error ER_XAER_RMFAIL.

Simply the check should be added: thd->transaction.xid_state.check_has_uncommitted_xa()

Nikita Malyavin added a comment - 2021-10-07 13:41 Right, changing the last line as follows: CREATE TABLE t (a INT KEY ) ENGINE=InnoDB; HANDLER t OPEN AS t; XA START '0' ; SELECT * FROM t; XA END '0' ; XA PREPARE '0' ; SELECT * FROM t; would lead to an error ER_XAER_RMFAIL. Simply the check should be added: thd->transaction.xid_state.check_has_uncommitted_xa()

Nikita Malyavin added a comment - 2021-10-07 15:34

The patch for review is: https://github.com/MariaDB/server/commit/65e2c2859d4e3ff7e7a035df571996ceb8b95c92

Nikita Malyavin added a comment - 2021-10-07 15:34 The patch for review is: https://github.com/MariaDB/server/commit/65e2c2859d4e3ff7e7a035df571996ceb8b95c92

Aleksey Midenkov added a comment - 2021-10-11 12:01

Ok to push.

Aleksey Midenkov added a comment - 2021-10-11 12:01 Ok to push.

MariaDB Server

Crash on HANDLER READ NEXT after XA PREPARE

Details

Description

Attachments

Issue Links

Activity

People

Dates

Git Integration