Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23753

SIGSEGV in Column_stat::store_stat_fields (on optimized builds)

Details

    Description

      SET SQL_MODE='';
      CREATE TABLE t (c INT) ENGINE=InnoDB PARTITION BY HASH (c) PARTITIONS 2;
      LOCK TABLES t WRITE;
      ANALYZE TABLE t PERSISTENT FOR COLUMNS (b) INDEXES (i);
      

      Leads to:

      10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Optimized)

      Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      [Current thread is 1 (Thread 0x15096a935700 (LWP 3858289))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      #1  0x0000558d23378ae7 in my_write_core (sig=sig@entry=11) at /data/10.5_opt/mysys/stacktrace.c:424
      #2  0x0000558d22d47fda in handle_fatal_signal (sig=11) at /data/10.5_opt/sql/signal_handler.cc:330
      #3  <signal handler called>
      #4  0x0000558d22bcbd3c in Column_stat::store_stat_fields (this=<synthetic pointer>) at /data/10.5_opt/sql/sql_statistics.cc:1044
      #5  Stat_table::update_stat (this=<synthetic pointer>) at /data/10.5_opt/sql/sql_statistics.cc:654
      #6  update_statistics_for_table (thd=thd@entry=0x150946c12018, table=0x150946c86818) at /data/10.5_opt/sql/sql_statistics.cc:2826
      #7  0x0000558d22c4bcfb in mysql_admin_table (thd=thd@entry=0x150946c12018, tables=tables@entry=0x150946c47138, check_opt=check_opt@entry=0x150946c17288, operator_name=operator_name@entry=0x558d234d889a "analyze", lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=true, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=<optimized out>, view_operator_func=0x0) at /data/10.5_opt/sql/sql_admin.cc:895
      #8  0x0000558d22c4ca5d in Sql_cmd_analyze_table::execute (this=<optimized out>, thd=0x150946c12018) at /data/10.5_opt/sql/sql_admin.cc:1327
      #9  0x0000558d22b4deff in mysql_execute_command (thd=thd@entry=0x150946c12018) at /data/10.5_opt/sql/sql_parse.cc:5952
      #10 0x0000558d22b54a2c in mysql_parse (thd=0x150946c12018, rawbuf=<optimized out>, length=54, parser_state=0x15096a934430, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /data/10.5_opt/sql/sql_parse.cc:7994
      #11 0x0000558d22b49cc5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x150946c12018, packet=packet@entry=0x150946c3a019 "", packet_length=packet_length@entry=54, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /data/10.5_opt/sql/sql_parse.cc:1867
      #12 0x0000558d22b47fe4 in do_command (thd=0x150946c12018) at /data/10.5_opt/sql/sql_parse.cc:1348
      #13 0x0000558d22c3eba1 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1509678338f8, put_in_cache=put_in_cache@entry=true) at /data/10.5_opt/sql/sql_connect.cc:1410
      #14 0x0000558d22c3ef14 in handle_one_connection (arg=arg@entry=0x1509678338f8) at /data/10.5_opt/sql/sql_connect.cc:1312
      #15 0x0000558d22fb2a4a in pfs_spawn_thread (arg=0x15096784f018) at /data/10.5_opt/storage/perfschema/pfs.cc:2201
      #16 0x00001509698ae6db in start_thread (arg=0x15096a935700) at pthread_create.c:463
      #17 0x0000150968caca3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Debug)

      Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
          at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      [Current thread is 1 (Thread 0x14e4d53d9700 (LWP 3425713))]
      (gdb) bt
      #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
      #1  0x0000555846a2e85a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424
      #2  0x00005558461f53a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
      #3  <signal handler called>
      #4  0x0000555845ffd77b in Column_stat::store_stat_fields (this=0x14e4d53d2660) at /test/10.5_dbg/sql/sql_statistics.cc:1049
      #5  0x0000555845ff62e6 in Stat_table::update_stat (this=0x14e4d53d2660) at /test/10.5_dbg/sql/sql_statistics.cc:654
      #6  update_statistics_for_table (thd=thd@entry=0x14e4b1015088, table=0x14e4b1052088) at /test/10.5_dbg/sql/sql_statistics.cc:2826
      #7  0x00005558460acd8f in mysql_admin_table (thd=thd@entry=0x14e4b1015088, tables=tables@entry=0x14e4b10741a8, check_opt=check_opt@entry=0x14e4b101a4b8, operator_name=operator_name@entry=0x555846dce6a0 "analyze", lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=true, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x555846203dc0 <handler::ha_analyze(THD*, st_ha_check_opt*)>, view_operator_func=0x0) at /test/10.5_dbg/sql/sql_admin.cc:895
      #8  0x00005558460ae693 in Sql_cmd_analyze_table::execute (this=<optimized out>, thd=0x14e4b1015088) at /test/10.5_dbg/sql/sql_admin.cc:1327
      #9  0x0000555845f479b0 in mysql_execute_command (thd=thd@entry=0x14e4b1015088) at /test/10.5_dbg/sql/sql_parse.cc:5952
      #10 0x0000555845f4f324 in mysql_parse (thd=thd@entry=0x14e4b1015088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e4d53d8350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994
      #11 0x0000555845f3bd54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e4b1015088, packet=packet@entry=0x14e4b1067089 "", packet_length=packet_length@entry=54, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867
      #12 0x0000555845f3a53e in do_command (thd=0x14e4b1015088) at /test/10.5_dbg/sql/sql_parse.cc:1348
      #13 0x0000555846099893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x14e4b44d4808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410
      #14 0x0000555846099fb7 in handle_one_connection (arg=arg@entry=0x14e4b44d4808) at /test/10.5_dbg/sql/sql_connect.cc:1312
      #15 0x00005558465045c2 in pfs_spawn_thread (arg=0x14e4d2046508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
      #16 0x000014e4d43526db in start_thread (arg=0x14e4d53d9700) at pthread_create.c:463
      #17 0x000014e4d3750a3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.2.34 (dbg), 10.2.34 (opt), 10.3.25 (dbg), 10.3.25 (opt), 10.4.15 (dbg), 10.4.15 (opt), 10.5.6 (dbg), 10.5.6 (opt)

      Bug confirmed not present in:
      MariaDB: 10.1.47 (dbg), 10.1.47 (opt), 10.6.0 (dbg), 10.6.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.49 (dbg), 5.6.49 (opt), 5.7.31 (dbg), 5.7.31 (opt), 8.0.21 (dbg), 8.0.21 (opt)

      Attachments

        Activity

          varun Varun Gupta (Inactive) added a comment - - edited

          Also reproducible on 10.1, here is a mtr test case

          --source include/have_partition.inc
          CREATE TABLE t1 (a INT, b INT) PARTITION BY HASH (b) PARTITIONS 2;
          LOCK TABLES t1 WRITE;
          ANALYZE TABLE t1 PERSISTENT FOR COLUMNS () INDEXES ();
          DROP TABLE t1;
          

          varun Varun Gupta (Inactive) added a comment - - edited Also reproducible on 10.1, here is a mtr test case --source include/have_partition.inc CREATE TABLE t1 (a INT , b INT ) PARTITION BY HASH (b) PARTITIONS 2; LOCK TABLES t1 WRITE; ANALYZE TABLE t1 PERSISTENT FOR COLUMNS () INDEXES (); DROP TABLE t1;
          varun Varun Gupta (Inactive) added a comment - Patch http://lists.askmonty.org/pipermail/commits/2020-September/014333.html

          Thank you Varun for the quick patch

          Roel Roel Van de Paar added a comment - Thank you Varun for the quick patch

          Found a testcase which generates a different stack

          SET SQL_MODE='';
          CREATE TABLE t (a INT PRIMARY KEY) PARTITION BY HASH (a) PARTITIONS 2;
          INSERT INTO t VALUES (1);
          LOCK TABLES t WRITE;
          ANALYZE TABLE t PERSISTENT FOR COLUMNS (nonexisting) INDEXES (nonexisting);
          

          Leads to:

          10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Debug)

          Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
          Program terminated with signal SIGSEGV, Segmentation fault.
          #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11)
              at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
          [Current thread is 1 (Thread 0x1473e0903700 (LWP 4096474))]
          (gdb) bt
          #0  __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57
          #1  0x00005609b512385a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424
          #2  0x00005609b48ea3a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330
          #3  <signal handler called>
          #4  Field::is_null (row_offset=0, this=0x0) at /test/10.5_dbg/sql/field.h:1370
          #5  Column_statistics_collected::add (this=0x1473bc83cad0) at /test/10.5_dbg/sql/sql_statistics.cc:2368
          #6  collect_statistics_for_table (thd=thd@entry=0x1473bc815088, table=0x1473bc851188) at /test/10.5_dbg/sql/sql_statistics.cc:2690
          #7  0x00005609b47a1d78 in mysql_admin_table (thd=thd@entry=0x1473bc815088, tables=tables@entry=0x1473bc8741d8, check_opt=check_opt@entry=0x1473bc81a4b8, operator_name=operator_name@entry=0x5609b54c36a0 "analyze", lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=true, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x5609b48f8dc0 <handler::ha_analyze(THD*, st_ha_check_opt*)>, view_operator_func=0x0) at /test/10.5_dbg/sql/sql_admin.cc:892
          #8  0x00005609b47a3693 in Sql_cmd_analyze_table::execute (this=<optimized out>, thd=0x1473bc815088) at /test/10.5_dbg/sql/sql_admin.cc:1327
          #9  0x00005609b463c9b0 in mysql_execute_command (thd=thd@entry=0x1473bc815088) at /test/10.5_dbg/sql/sql_parse.cc:5952
          #10 0x00005609b4644324 in mysql_parse (thd=thd@entry=0x1473bc815088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1473e0902350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994
          #11 0x00005609b4630d54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1473bc815088, packet=packet@entry=0x1473bc867089 "", packet_length=packet_length@entry=74, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867
          #12 0x00005609b462f53e in do_command (thd=0x1473bc815088) at /test/10.5_dbg/sql/sql_parse.cc:1348
          #13 0x00005609b478e893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1473bf8d4808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410
          #14 0x00005609b478efb7 in handle_one_connection (arg=arg@entry=0x1473bf8d4808) at /test/10.5_dbg/sql/sql_connect.cc:1312
          #15 0x00005609b4bf95c2 in pfs_spawn_thread (arg=0x1473dd446508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201
          #16 0x00001473df87c6db in start_thread (arg=0x1473e0903700) at pthread_create.c:463
          #17 0x00001473dec7aa3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
          

          Bug confirmed present in:
          MariaDB: 10.2.34 (dbg), 10.2.34 (opt), 10.3.25 (dbg), 10.3.25 (opt), 10.4.15 (dbg), 10.4.15 (opt), 10.5.6 (dbg), 10.5.6 (opt), 10.6.0 (dbg), 10.6.0 (opt)

          Bug confirmed not present in:
          MariaDB: 10.1.47 (dbg), 10.1.47 (opt)
          MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.49 (dbg), 5.6.49 (opt), 5.7.31 (dbg), 5.7.31 (opt), 8.0.21 (dbg), 8.0.21 (opt)

          Roel Roel Van de Paar added a comment - Found a testcase which generates a different stack SET SQL_MODE=''; CREATE TABLE t (a INT PRIMARY KEY) PARTITION BY HASH (a) PARTITIONS 2; INSERT INTO t VALUES (1); LOCK TABLES t WRITE; ANALYZE TABLE t PERSISTENT FOR COLUMNS (nonexisting) INDEXES (nonexisting); Leads to: 10.5.6 2bac9782aa81ad386beaf00eb126ccf2d15031a1 (Debug) Core was generated by `/test/MD150920-mariadb-10.5.6-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'. Program terminated with signal SIGSEGV, Segmentation fault. #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 [Current thread is 1 (Thread 0x1473e0903700 (LWP 4096474))] (gdb) bt #0 __pthread_kill (threadid=<optimized out>, signo=signo@entry=11) at ../sysdeps/unix/sysv/linux/pthread_kill.c:57 #1 0x00005609b512385a in my_write_core (sig=sig@entry=11) at /test/10.5_dbg/mysys/stacktrace.c:424 #2 0x00005609b48ea3a9 in handle_fatal_signal (sig=11) at /test/10.5_dbg/sql/signal_handler.cc:330 #3 <signal handler called> #4 Field::is_null (row_offset=0, this=0x0) at /test/10.5_dbg/sql/field.h:1370 #5 Column_statistics_collected::add (this=0x1473bc83cad0) at /test/10.5_dbg/sql/sql_statistics.cc:2368 #6 collect_statistics_for_table (thd=thd@entry=0x1473bc815088, table=0x1473bc851188) at /test/10.5_dbg/sql/sql_statistics.cc:2690 #7 0x00005609b47a1d78 in mysql_admin_table (thd=thd@entry=0x1473bc815088, tables=tables@entry=0x1473bc8741d8, check_opt=check_opt@entry=0x1473bc81a4b8, operator_name=operator_name@entry=0x5609b54c36a0 "analyze", lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=org_open_for_modify@entry=true, repair_table_use_frm=false, extra_open_options=0, prepare_func=0x0, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x5609b48f8dc0 <handler::ha_analyze(THD*, st_ha_check_opt*)>, view_operator_func=0x0) at /test/10.5_dbg/sql/sql_admin.cc:892 #8 0x00005609b47a3693 in Sql_cmd_analyze_table::execute (this=<optimized out>, thd=0x1473bc815088) at /test/10.5_dbg/sql/sql_admin.cc:1327 #9 0x00005609b463c9b0 in mysql_execute_command (thd=thd@entry=0x1473bc815088) at /test/10.5_dbg/sql/sql_parse.cc:5952 #10 0x00005609b4644324 in mysql_parse (thd=thd@entry=0x1473bc815088, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x1473e0902350, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:7994 #11 0x00005609b4630d54 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1473bc815088, packet=packet@entry=0x1473bc867089 "", packet_length=packet_length@entry=74, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.5_dbg/sql/sql_parse.cc:1867 #12 0x00005609b462f53e in do_command (thd=0x1473bc815088) at /test/10.5_dbg/sql/sql_parse.cc:1348 #13 0x00005609b478e893 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1473bf8d4808, put_in_cache=put_in_cache@entry=true) at /test/10.5_dbg/sql/sql_connect.cc:1410 #14 0x00005609b478efb7 in handle_one_connection (arg=arg@entry=0x1473bf8d4808) at /test/10.5_dbg/sql/sql_connect.cc:1312 #15 0x00005609b4bf95c2 in pfs_spawn_thread (arg=0x1473dd446508) at /test/10.5_dbg/storage/perfschema/pfs.cc:2201 #16 0x00001473df87c6db in start_thread (arg=0x1473e0903700) at pthread_create.c:463 #17 0x00001473dec7aa3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95 Bug confirmed present in: MariaDB: 10.2.34 (dbg), 10.2.34 (opt), 10.3.25 (dbg), 10.3.25 (opt), 10.4.15 (dbg), 10.4.15 (opt), 10.5.6 (dbg), 10.5.6 (opt), 10.6.0 (dbg), 10.6.0 (opt) Bug confirmed not present in: MariaDB: 10.1.47 (dbg), 10.1.47 (opt) MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.49 (dbg), 5.6.49 (opt), 5.7.31 (dbg), 5.7.31 (opt), 8.0.21 (dbg), 8.0.21 (opt)

          Review comments:

          • I didn't like that you moved a call of ha_rnd_init() from collect_statistics_for_table() to alloc_statistics_for_table(). The reason is that if something goes wrong in alloc_statistics_for_table() or any other code that is executed before collect_statistics_for_table(), ha_rnd_end() will not be called.

          I fixed this by just calling ha_rnd_init() and ha_rnd_end() in alloc_statistics_for_table().
          Both test cases from the MDEV was added and I did run the test under valgrind and had now issues.
          Please review the new code (attached to this entry) and if you agree with the change, push to 10.2.

          monty Michael Widenius added a comment - Review comments: I didn't like that you moved a call of ha_rnd_init() from collect_statistics_for_table() to alloc_statistics_for_table(). The reason is that if something goes wrong in alloc_statistics_for_table() or any other code that is executed before collect_statistics_for_table(), ha_rnd_end() will not be called. I fixed this by just calling ha_rnd_init() and ha_rnd_end() in alloc_statistics_for_table(). Both test cases from the MDEV was added and I did run the test under valgrind and had now issues. Please review the new code (attached to this entry) and if you agree with the change, push to 10.2.

          monty your patch looks good, have made the changes and will push to 10.2

          varun Varun Gupta (Inactive) added a comment - monty your patch looks good, have made the changes and will push to 10.2

          People

            varun Varun Gupta (Inactive)
            Roel Roel Van de Paar
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.