Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-22787

fts_optimize_shutdown() deletes timer prematurely

    XMLWordPrintable

Details

    Description

      ASAN failure during shutdown on
      origin/bb-10.5-MDEV-15053-3 be3c9a23fd014ed80d48e2984dec78db921a7a00 2020-06-02T20:37:37+03:00
       
      2020-06-03 11:25:43 0 [Note] bin/mysqld (initiated by: root[root] @ localhost [127.0.0.1]): Normal shutdown
      2020-06-03 11:25:43 3 [Warning] Aborted connection 3 to db: 'mysql' user: 'root' host: 'localhost' (This connection closed normally)
      2020-06-03 11:25:44 0 [Note] Event Scheduler: Purging the queue. 0 events
      =================================================================
      ==19477==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000044c8 at pc 0x55c74d8b6675 bp 0x7479707197f0 sp 0x7479707197e0
      READ of size 1 at 0x6120000044c8 thread T105
          #0 0x55c74d8b6674 in tpool::thread_pool_generic::timer_generic::set_time(int, int) /home/mleich/bb-10.5-MDEV-15053-3/tpool/tpool_generic.cc:348
          #1 0x55c74d812496 in fts_optimize_callback storage/innobase/fts/fts0opt.cc:2872
          #2 0x55c74d8c131f in tpool::task_group::execute(tpool::task*) tpool/task_group.cc:55
          #3 0x55c74d8c1c6a in tpool::task::execute() tpool/task.cc:47
          #4 0x55c74d8b218d in tpool::thread_pool_generic::worker_main(tpool::worker_data*) tpool/tpool_generic.cc:518
          #5 0x55c74d8baae5 in void std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*>(std::__invoke_memfun_deref, void (tpool::thread_pool_generic::*&&)(tpool::worker_data*), tpool::thread_pool_generic*&&, tpool::worker_data*&&) /usr/include/c++/7/bits/invoke.h:73
          #6 0x55c74d8b88ec in std::__invoke_result<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*>::type std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*>(void (tpool::thread_pool_generic::*&&)(tpool::worker_data*), tpool::thread_pool_generic*&&, tpool::worker_data*&&) /usr/include/c++/7/bits/invoke.h:95
          #7 0x55c74d8c0c56 in decltype (__invoke((_S_declval<0ul>)(), (_S_declval<1ul>)(), (_S_declval<2ul>)())) std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::_M_invoke<0ul, 1ul, 2ul>(std::_Index_tuple<0ul, 1ul, 2ul>) (bin/mariadbd+0x35b4c56)
          #8 0x55c74d8c0ba4 in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::operator()() (bin/mariadbd+0x35b4ba4)
          #9 0x55c74d8c0b05 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> > >::_M_run() (bin/mariadbd+0x35b4b05)
          #10 0x3204548e46de  (/usr/lib/x86_64-linux-gnu/libstdc++.so.6+0xbd6de)
          #11 0x31295b0e06da in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76da)
          #12 0x320454eed88e in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x12188e)
      ...
      SUMMARY: AddressSanitizer: heap-use-after-free tpool/tpool_generic.cc:348 in tpool::thread_pool_generic::timer_generic::set_time(int, int)
       
      RQG
      -------
      git clone https://github.com/mleich1/rqg --branch experimental RQG_mleich
      origin/experimental 5c63068c24fa6d687422f4d26490b067ff6535e4 2020-05-28T13:50:30+02:00
       
      perl rqg.pl \                        
      --mysqld=--loose-innodb_lock_schedule_algorithm=fcfs \
      --gendata=conf/mariadb/table_stress.zz \
      --gendata_sql=conf/mariadb/table_stress.sql \
      --engine=Innodb \
      --reporters=Deadlock1,ErrorLog,Backtrace \
      --mysqld=--connect_timeout=60 \
      --mysqld=--net_read_timeout=30 \
      --mysqld=--net_write_timeout=60 \
      --mysqld=--loose-idle_readonly_transaction_timeout=0 \
      --mysqld=--loose-idle_transaction_timeout=0 \
      --mysqld=--loose-idle_write_transaction_timeout=0 \
      --mysqld=--interactive_timeout=28800 \
      --mysqld=--lock_wait_timeout=86400 \
      --mysqld=--innodb-lock-wait-timeout=50 \
      --mysqld=--loose-table_lock_wait_timeout=50 \
      --mysqld=--wait_timeout=28800 \
      --mysqld=--slave_net_timeout=60 \
      --mysqld=--loose-max-statement-time=30 \
      --mysqld=--loose-debug_assert_on_not_freed_memory=0 \
      --mysqld=--log-output=none \
      --mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
      --duration=300 \
      --seed=random \
      --grammar=conf/mariadb/table_stress_innodb.yy \
      --threads=33 \
      --mysqld=--innodb_stats_persistent=ON \
      --mysqld=--innodb_adaptive_hash_index=ON \
      --mysqld=--innodb_page_size=64K \
      --mysqld=--innodb-buffer-pool-size=24M \
      --duration=300 \
      --no_mask \
      --workdir=<local settings> \
      --vardir=<local settings> \
      --mtr-build-thread=<local settings> \
      --basedir1=<local settings> \
      --basedir2=<local settings> \
      --script_debug=_nix_ \
      --rr=Server \
      --rr_options=--chaos
       
      Per first analysis of Marko fts_optimize_shutdown() should somehow wait that fts_optimize_callback() finishes.
      

      Attachments

        1. 000686.log
          226 kB
          Matthias Leich

        Issue Links

          Activity

            People

              marko Marko Mäkelä
              mleich Matthias Leich
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.