Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23794

Server crashes in bitmap_bits_set / pack_row / THD::binlog_write_row or bitmap_is_set / max_row_length / THD::binlog_write_row

    XMLWordPrintable

Details

    Description

      --source include/have_innodb.inc
      --source include/have_partition.inc
      --source include/have_binlog_format_row.inc
       
      CREATE TABLE t1 (a INT) ENGINE=InnoDB PARTITION BY RANGE (a) (PARTITION p0 VALUES LESS THAN (0), PARTITION pn VALUES LESS THAN MAXVALUE);
      INSERT INTO t1 VALUES (1),(2);
      ALTER TABLE t1 DROP a, ADD a INT;
      ALTER TABLE t1 REPAIR PARTITION pn;
       
      # Cleanup
      DROP TABLE t1;
      

      10.2 e05650e6

      #3  <signal handler called>
      #4  0x0000562332cafcf3 in bitmap_bits_set (map=0x0) at /data/src/10.2/mysys/my_bitmap.c:610
      #5  0x000056233265c64f in pack_row (table=0x7febf80a2260, cols=0x0, row_data=0x7febf808fcf0 '\245' <repeats 14 times>, '\217' <repeats 186 times>..., record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/rpl_record.cc:65
      #6  0x00005623322595e5 in THD::binlog_write_row (this=0x7febf8000d90, table=0x7febf80a2260, is_trans=true, record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/sql_class.cc:6413
      #7  0x000056233252ba41 in Write_rows_log_event::binlog_row_logging_function (thd=0x7febf8000d90, table=0x7febf80a2260, is_transactional=true, before_record=0x0, after_record=0x7febf80a2e88 "\377") at /data/src/10.2/sql/log_event.h:4727
      #8  0x0000562332528b96 in binlog_log_row_internal (table=0x7febf80a2260, before_record=0x0, after_record=0x7febf80a2e88 "\377", log_func=0x56233252ba08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5952
      #9  0x0000562332528d6f in binlog_log_row (table=0x7febf80a2260, before_record=0x0, after_record=0x7febf80a2e88 "\377", log_func=0x56233252ba08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5988
      #10 0x00005623325294bd in handler::ha_write_row (this=0x7febf808d158, buf=0x7febf80a2e88 "\377") at /data/src/10.2/sql/handler.cc:6115
      #11 0x0000562332c3a542 in ha_partition::check_misplaced_rows (this=0x7febf8035348, read_part_id=1, do_repair=true) at /data/src/10.2/sql/ha_partition.cc:8991
      #12 0x0000562332c28369 in ha_partition::handle_opt_part (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8, part_id=1, flag=4) at /data/src/10.2/sql/ha_partition.cc:1247
      #13 0x0000562332c28b1c in ha_partition::handle_opt_partitions (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8, flag=4) at /data/src/10.2/sql/ha_partition.cc:1406
      #14 0x0000562332c28065 in ha_partition::repair (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8) at /data/src/10.2/sql/ha_partition.cc:1159
      #15 0x00005623325246c5 in handler::ha_repair (this=0x7febf8035348, thd=0x7febf8000d90, check_opt=0x7febf80058a8) at /data/src/10.2/sql/handler.cc:4157
      #16 0x00005623323fe927 in mysql_admin_table (thd=0x7febf8000d90, tables=0x7febf80128f0, check_opt=0x7febf80058a8, operator_name=0x562332d87065 "repair", lock_type=TL_WRITE, org_open_for_modify=true, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x5623323fc90b <prepare_for_repair(THD*, TABLE_LIST*, HA_CHECK_OPT*)>, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x56233252467c <handler::ha_repair(THD*, st_ha_check_opt*)>, view_operator_func=0x5623323981b9 <view_repair(THD*, TABLE_LIST*, st_ha_check_opt*)>) at /data/src/10.2/sql/sql_admin.cc:788
      #17 0x000056233240109a in Sql_cmd_repair_table::execute (this=0x7febf8012f28, thd=0x7febf8000d90) at /data/src/10.2/sql/sql_admin.cc:1403
      #18 0x00005623326e12db in Sql_cmd_alter_table_repair_partition::execute (this=0x7febf8012f28, thd=0x7febf8000d90) at /data/src/10.2/sql/sql_partition_admin.cc:725
      #19 0x00005623322a0c21 in mysql_execute_command (thd=0x7febf8000d90) at /data/src/10.2/sql/sql_parse.cc:5964
      #20 0x00005623322a5c37 in mysql_parse (thd=0x7febf8000d90, rawbuf=0x7febf80127f8 "ALTER TABLE t1 REPAIR PARTITION pn", length=34, parser_state=0x7fec49a805f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7733
      #21 0x0000562332293f46 in dispatch_command (command=COM_QUERY, thd=0x7febf8000d90, packet=0x7febf8008c51 "", packet_length=34, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1823
      #22 0x0000562332292a41 in do_command (thd=0x7febf8000d90) at /data/src/10.2/sql/sql_parse.cc:1377
      #23 0x00005623323ec413 in do_handle_one_connection (connect=0x5623349716d0) at /data/src/10.2/sql/sql_connect.cc:1336
      #24 0x00005623323ec178 in handle_one_connection (arg=0x5623349716d0) at /data/src/10.2/sql/sql_connect.cc:1241
      #25 0x0000562332c10782 in pfs_spawn_thread (arg=0x56233497a450) at /data/src/10.2/storage/perfschema/pfs.cc:1869
      #26 0x00007fec4fb6f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #27 0x00007fec4f749103 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Reproducible on 10.1-10.4, non-debug, debug and ASAN builds alike.
      Not reproducible on 10.5.

      A slight change in the test case causes somewhat different stack trace (the difference is in the first ALTER):

      --source include/have_innodb.inc
      --source include/have_partition.inc
      --source include/have_binlog_format_row.inc
       
      CREATE TABLE t1 (a INT) ENGINE=InnoDB PARTITION BY RANGE (a) (PARTITION p0 VALUES LESS THAN (0), PARTITION pn VALUES LESS THAN MAXVALUE);
      INSERT INTO t1 VALUES (1),(2);
      ALTER TABLE t1 DROP a, ADD (x TEXT, a INT);
      ALTER TABLE t1 REPAIR PARTITION pn;
       
      # Cleanup
      DROP TABLE t1;
      

      10.2 e05650e6

      #3  <signal handler called>
      #4  0x0000558f8d3428ac in bitmap_is_set (map=0x0, bit=0) at /data/src/10.2/include/my_bitmap.h:131
      #5  0x0000558f8d357ebb in max_row_length (table=0x7f34d80a2260, cols=0x0, data=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/table.cc:7557
      #6  0x0000558f8d20257e in THD::binlog_write_row (this=0x7f34d8000d90, table=0x7f34d80a2260, is_trans=true, record=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/sql_class.cc:6407
      #7  0x0000558f8d4d4a41 in Write_rows_log_event::binlog_row_logging_function (thd=0x7f34d8000d90, table=0x7f34d80a2260, is_transactional=true, before_record=0x0, after_record=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/log_event.h:4727
      #8  0x0000558f8d4d1b96 in binlog_log_row_internal (table=0x7f34d80a2260, before_record=0x0, after_record=0x7f34d80a2e88 "\377", log_func=0x558f8d4d4a08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5952
      #9  0x0000558f8d4d1d6f in binlog_log_row (table=0x7f34d80a2260, before_record=0x0, after_record=0x7f34d80a2e88 "\377", log_func=0x558f8d4d4a08 <Write_rows_log_event::binlog_row_logging_function(THD*, TABLE*, bool, unsigned char const*, unsigned char const*)>) at /data/src/10.2/sql/handler.cc:5988
      #10 0x0000558f8d4d24bd in handler::ha_write_row (this=0x7f34d808d468, buf=0x7f34d80a2e88 "\377") at /data/src/10.2/sql/handler.cc:6115
      #11 0x0000558f8dbe3542 in ha_partition::check_misplaced_rows (this=0x7f34d8035348, read_part_id=1, do_repair=true) at /data/src/10.2/sql/ha_partition.cc:8991
      #12 0x0000558f8dbd1369 in ha_partition::handle_opt_part (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8, part_id=1, flag=4) at /data/src/10.2/sql/ha_partition.cc:1247
      #13 0x0000558f8dbd1b1c in ha_partition::handle_opt_partitions (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8, flag=4) at /data/src/10.2/sql/ha_partition.cc:1406
      #14 0x0000558f8dbd1065 in ha_partition::repair (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8) at /data/src/10.2/sql/ha_partition.cc:1159
      #15 0x0000558f8d4cd6c5 in handler::ha_repair (this=0x7f34d8035348, thd=0x7f34d8000d90, check_opt=0x7f34d80058a8) at /data/src/10.2/sql/handler.cc:4157
      #16 0x0000558f8d3a7927 in mysql_admin_table (thd=0x7f34d8000d90, tables=0x7f34d80128f0, check_opt=0x7f34d80058a8, operator_name=0x558f8dd30065 "repair", lock_type=TL_WRITE, org_open_for_modify=true, repair_table_use_frm=false, extra_open_options=32, prepare_func=0x558f8d3a590b <prepare_for_repair(THD*, TABLE_LIST*, HA_CHECK_OPT*)>, operator_func=(int (handler::*)(class handler * const, class THD *, HA_CHECK_OPT *)) 0x558f8d4cd67c <handler::ha_repair(THD*, st_ha_check_opt*)>, view_operator_func=0x558f8d3411b9 <view_repair(THD*, TABLE_LIST*, st_ha_check_opt*)>) at /data/src/10.2/sql/sql_admin.cc:788
      #17 0x0000558f8d3aa09a in Sql_cmd_repair_table::execute (this=0x7f34d8012f28, thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_admin.cc:1403
      #18 0x0000558f8d68a2db in Sql_cmd_alter_table_repair_partition::execute (this=0x7f34d8012f28, thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_partition_admin.cc:725
      #19 0x0000558f8d249c21 in mysql_execute_command (thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_parse.cc:5964
      #20 0x0000558f8d24ec37 in mysql_parse (thd=0x7f34d8000d90, rawbuf=0x7f34d80127f8 "ALTER TABLE t1 REPAIR PARTITION pn", length=34, parser_state=0x7f352c0755f0, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:7733
      #21 0x0000558f8d23cf46 in dispatch_command (command=COM_QUERY, thd=0x7f34d8000d90, packet=0x7f34d8008c51 "", packet_length=34, is_com_multi=false, is_next_command=false) at /data/src/10.2/sql/sql_parse.cc:1823
      #22 0x0000558f8d23ba41 in do_command (thd=0x7f34d8000d90) at /data/src/10.2/sql/sql_parse.cc:1377
      #23 0x0000558f8d395413 in do_handle_one_connection (connect=0x558f90e256e0) at /data/src/10.2/sql/sql_connect.cc:1336
      #24 0x0000558f8d395178 in handle_one_connection (arg=0x558f90e256e0) at /data/src/10.2/sql/sql_connect.cc:1241
      #25 0x0000558f8dbb9782 in pfs_spawn_thread (arg=0x558f90e2e460) at /data/src/10.2/storage/perfschema/pfs.cc:1869
      #26 0x00007f3531947609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #27 0x00007f3531521103 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Attachments

        Activity

          People

            Elkin Andrei Elkin
            elenst Elena Stepanova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.