Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23202

Server crashes in maria_status and/or heap_info upon 2nd execution of SP

    XMLWordPrintable

Details

    Description

      PSEUDO_THREAD_ID in the test case makes it much less important, as it's intended for "internal use only". However, it's possible that there is a use case where this internal use is triggered and similarly affected. It needs to be investigated at least.

      CREATE TABLE t (a INT);
      		 
      CREATE VIEW v AS SELECT 1 FROM t;
      		 
      SET big_tables= 1; # Not needed for 10.5+
      		 
      CREATE PROCEDURE p() SELECT 2 FROM v;
      		 
      CREATE TEMPORARY TABLE v SELECT 3 AS b;
      		 
      CALL p();
      		 
      SET PSEUDO_THREAD_ID= 111;
      		 
      CALL p();
      		 
       
      		 
      # Cleanup
      		 
      DROP PROCEDURE p;
      		 
      DROP VIEW v;
      		 
      DROP TABLE t;

      10.2 debug a1e52e7f

      		 
      #3  <signal handler called>
      		 
      #4  0x0000560e0fb934f5 in maria_status (info=0x0, x=0x7f173c2f3dd0, flag=18) at /data/src/10.2/storage/maria/ma_info.c:43
      		 
      #5  0x0000560e0fbaa71d in ha_maria::info (this=0x7f17200400e8, flag=18) at /data/src/10.2/storage/maria/ha_maria.cc:2516
      		 
      #6  0x0000560e0f4b0eb1 in TABLE_LIST::fetch_number_of_rows (this=0x7f1720085e40) at /data/src/10.2/sql/table.cc:8286
      		 
      #7  0x0000560e0f3e5b42 in make_join_statistics (join=0x7f1720038d00, tables_list=..., keyuse_array=0x7f1720038ff0) at /data/src/10.2/sql/sql_select.cc:3969
      		 
      #8  0x0000560e0f3dd9b8 in JOIN::optimize_inner (this=0x7f1720038d00) at /data/src/10.2/sql/sql_select.cc:1584
      		 
      #9  0x0000560e0f3dbe81 in JOIN::optimize (this=0x7f1720038d00) at /data/src/10.2/sql/sql_select.cc:1113
      		 
      #10 0x0000560e0f3e53d8 in mysql_select (thd=0x7f1720000af0, tables=0x7f1720085e40, wild_num=0, fields=..., conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x7f1720038ce0, unit=0x7f1720087978, select_lex=0x7f17200880b8) at /data/src/10.2/sql/sql_select.cc:3819
      		 
      #11 0x0000560e0f3d9626 in handle_select (thd=0x7f1720000af0, lex=0x7f17200878b8, result=0x7f1720038ce0, setup_tables_done_option=0) at /data/src/10.2/sql/sql_select.cc:361
      		 
      #12 0x0000560e0f3a5070 in execute_sqlcom_select (thd=0x7f1720000af0, all_tables=0x7f1720085e40) at /data/src/10.2/sql/sql_parse.cc:6218
      		 
      #13 0x0000560e0f39b8f1 in mysql_execute_command (thd=0x7f1720000af0) at /data/src/10.2/sql/sql_parse.cc:3524
      		 
      #14 0x0000560e0f2f0562 in sp_instr_stmt::exec_core (this=0x7f1720086468, thd=0x7f1720000af0, nextp=0x7f173c2f55ec) at /data/src/10.2/sql/sp_head.cc:3332
      		 
      #15 0x0000560e0f2efbdb in sp_lex_keeper::reset_lex_and_exec_core (this=0x7f17200864a8, thd=0x7f1720000af0, nextp=0x7f173c2f55ec, open_tables=false, instr=0x7f1720086468) at /data/src/10.2/sql/sp_head.cc:3095
      		 
      #16 0x0000560e0f2f0213 in sp_instr_stmt::execute (this=0x7f1720086468, thd=0x7f1720000af0, nextp=0x7f173c2f55ec) at /data/src/10.2/sql/sp_head.cc:3248
      		 
      #17 0x0000560e0f2eb26d in sp_head::execute (this=0x7f17200851d8, thd=0x7f1720000af0, merge_da_on_success=true) at /data/src/10.2/sql/sp_head.cc:1326
      		 
      #18 0x0000560e0f2ed45a in sp_head::execute_procedure (this=0x7f17200851d8, thd=0x7f1720000af0, args=0x7f1720005430) at /data/src/10.2/sql/sp_head.cc:2202
      		 
      #19 0x0000560e0f399e94 in do_execute_sp (thd=0x7f1720000af0, sp=0x7f17200851d8) at /data/src/10.2/sql/sql_parse.cc:2946
      		 
      #20 0x0000560e0f3a2717 in mysql_execute_command (thd=0x7f1720000af0) at /data/src/10.2/sql/sql_parse.cc:5564
      		 
      #21 0x0000560e0f3a8da7 in mysql_parse (thd=0x7f1720000af0, rawbuf=0x7f1720012458 "CALL p()", length=8, parser_state=0x7f173c2f6610, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7733
      		 
      #22 0x0000560e0f3970d3 in dispatch_command (command=COM_QUERY, thd=0x7f1720000af0, packet=0x7f172008d4a1 "CALL p()", packet_length=8, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1824
      		 
      #23 0x0000560e0f395b4e in do_command (thd=0x7f1720000af0) at /data/src/10.2/sql/sql_parse.cc:1377
      		 
      #24 0x0000560e0f4ebb29 in do_handle_one_connection (connect=0x560e11659960) at /data/src/10.2/sql/sql_connect.cc:1336
      		 
      #25 0x0000560e0f4eb894 in handle_one_connection (arg=0x560e11659960) at /data/src/10.2/sql/sql_connect.cc:1241
      		 
      #26 0x0000560e0fd02352 in pfs_spawn_thread (arg=0x560e11664750) at /data/src/10.2/storage/perfschema/pfs.cc:1869
      		 
      #27 0x00007f1742fa54a4 in start_thread (arg=0x7f173c2f7700) at pthread_create.c:456
      		 
      #28 0x00007f17410d9d0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

      10.2 non-debug a1e52e7f

      		 
      #3  <signal handler called>
      		 
      #4  maria_status (info=0x0, x=x@entry=0x7ff83c2219e0, flag=flag@entry=18) at /data/src/10.2/storage/maria/ma_info.c:47
      		 
      #5  0x0000563613a653dd in ha_maria::info (this=0x7ff8200996d0, flag=18) at /data/src/10.2/storage/maria/ha_maria.cc:2516
      		 
      #6  0x000056361350f006 in make_join_statistics (join=join@entry=0x7ff820095458, tables_list=..., keyuse_array=keyuse_array@entry=0x7ff820095748) at /data/src/10.2/sql/sql_select.cc:3969
      		 
      #7  0x0000563613516aeb in JOIN::optimize_inner (this=this@entry=0x7ff820095458) at /data/src/10.2/sql/sql_select.cc:1584
      		 
      #8  0x0000563613519092 in JOIN::optimize (this=0x7ff820095458) at /data/src/10.2/sql/sql_select.cc:1113
      		 
      #9  0x0000563613519ad1 in mysql_select (thd=thd@entry=0x7ff8200009a8, tables=0x7ff82008df48, wild_num=0, fields=..., conds=<optimized out>, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2147749632, result=0x7ff820095438, unit=0x7ff82008f3d0, select_lex=0x7ff82008fb10) at /data/src/10.2/sql/sql_select.cc:3819
      		 
      #10 0x0000563613519c75 in handle_select (thd=thd@entry=0x7ff8200009a8, lex=lex@entry=0x7ff82008f310, result=result@entry=0x7ff820095438, setup_tables_done_option=setup_tables_done_option@entry=0) at /data/src/10.2/sql/sql_select.cc:361
      		 
      #11 0x00005636133f738f in execute_sqlcom_select (thd=thd@entry=0x7ff8200009a8, all_tables=0x7ff82008df48) at /data/src/10.2/sql/sql_parse.cc:6218
      		 
      #12 0x00005636134c43a1 in mysql_execute_command (thd=0x7ff8200009a8) at /data/src/10.2/sql/sql_parse.cc:3524
      		 
      #13 0x000056361344c4f5 in sp_instr_stmt::exec_core (this=0x7ff82008e570, thd=<optimized out>, nextp=0x7ff83c223c64) at /data/src/10.2/sql/sp_head.cc:3332
      		 
      #14 0x00005636134528ed in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x7ff82008e5b0, thd=thd@entry=0x7ff8200009a8, nextp=nextp@entry=0x7ff83c223c64, open_tables=open_tables@entry=false, instr=instr@entry=0x7ff82008e570) at /data/src/10.2/sql/sp_head.cc:3095
      		 
      #15 0x0000563613452f04 in sp_instr_stmt::execute (this=0x7ff82008e570, thd=0x7ff8200009a8, nextp=0x7ff83c223c64) at /data/src/10.2/sql/sp_head.cc:3248
      		 
      #16 0x000056361344f500 in sp_head::execute (this=this@entry=0x7ff82008d2e0, thd=thd@entry=0x7ff8200009a8, merge_da_on_success=merge_da_on_success@entry=true) at /data/src/10.2/sql/sp_head.cc:1326
      		 
      #17 0x0000563613450c0e in sp_head::execute_procedure (this=0x7ff82008d2e0, thd=thd@entry=0x7ff8200009a8, args=0x7ff820005128) at /data/src/10.2/sql/sp_head.cc:2202
      		 
      #18 0x00005636134bafd0 in do_execute_sp (thd=thd@entry=0x7ff8200009a8, sp=<optimized out>) at /data/src/10.2/sql/sql_parse.cc:2946
      		 
      #19 0x00005636134c42b3 in mysql_execute_command (thd=thd@entry=0x7ff8200009a8) at /data/src/10.2/sql/sql_parse.cc:5574
      		 
      #20 0x00005636134ca6aa in mysql_parse (thd=thd@entry=0x7ff8200009a8, rawbuf=<optimized out>, length=8, parser_state=parser_state@entry=0x7ff83c225620, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.2/sql/sql_parse.cc:7733
      		 
      #21 0x00005636134ccf30 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7ff8200009a8, packet=packet@entry=0x7ff820006d09 "CALL p()", packet_length=packet_length@entry=8, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/src/10.2/sql/sql_parse.cc:1824
      		 
      #22 0x00005636134cdcf0 in do_command (thd=0x7ff8200009a8) at /data/src/10.2/sql/sql_parse.cc:1377
      		 
      #23 0x000056361359a592 in do_handle_one_connection (connect=connect@entry=0x5636161c8b28) at /data/src/10.2/sql/sql_connect.cc:1336
      		 
      #24 0x000056361359a6ed in handle_one_connection (arg=arg@entry=0x5636161c8b28) at /data/src/10.2/sql/sql_connect.cc:1241
      		 
      #25 0x0000563613b5c7d1 in pfs_spawn_thread (arg=0x56361615d9e8) at /data/src/10.2/storage/perfschema/pfs.cc:1869
      		 
      #26 0x00007ff84219f4a4 in start_thread (arg=0x7ff83c226700) at pthread_create.c:456
      		 
      #27 0x00007ff84121dd0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

      Until 10.5, the test case needs BIG_TABLES to crash. Without it, it instead causes an error upon 2nd execution:

      CURRENT_TEST: bug2.fetch2
      		 
      mysqltest: At line 8: query 'CALL p()' failed: 1030: Got error 1 "Operation not permitted" from storage engine MEMORY

      Starting from 10.5, BIG_TABLES is irrelevant, the crash happens either way.

      Both debug and non-debug builds are affected.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-21413 ASAN heap-use-after-free in ha_maria::info

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-24383 SIGSEGV in heap_info from make_join_statistics on 2nd SP exec

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-24651 SIGSEGV in maria_scan_init on EXECUTE when using big_tables=on

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25570 Use of RAND() in procedure crashes server

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            People

              shulga Dmitry Shulga
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.