Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-23956

Server crash or ASAN errors in myrocks::ha_rocksdb::index_first / myrocks::ha_rocksdb::inplace_populate_sk / ha_rocksdb::can_use_bloom_filter / rocksdb::DBImpl::NewIterator

Details

    Description

      It can be related to MDEV-23952. The test cases are very similar, but the failure is not, so I'm filing it separately.

      10.3 469a249a

      #3  <signal handler called>
      #4  myrocks::ha_rocksdb::index_first (this=0x7f18e001ea38, buf=0x7f18e001b6f0 "\377") at /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:9124
      #5  0x00007f192d503b17 in myrocks::ha_rocksdb::inplace_populate_sk (this=0x7f18e001ea38, new_table_arg=0x7f18e0023cb0, indexes=Python Exception <class 'gdb.error'> No type named std::__detail::_Hash_node<class std::shared_ptr<myrocks::Rdb_key_def>, false>.: 
      std::unordered_set with 1 element) at /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12746
      #6  0x00007f192d5035aa in myrocks::ha_rocksdb::inplace_alter_table (this=0x7f18e001ea38, altered_table=0x7f18e0023cb0, ha_alter_info=0x7f192566c1b0) at /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12634
      #7  0x0000556431a29a87 in handler::ha_inplace_alter_table (this=0x7f18e001ea38, altered_table=0x7f18e0023cb0, ha_alter_info=0x7f192566c1b0) at /data/src/10.3/sql/handler.h:4207
      #8  0x0000556431a1de34 in mysql_inplace_alter_table (thd=0x7f18e0000d90, table_list=0x7f18e00117e8, table=0x7f18e001ddf0, altered_table=0x7f18e0023cb0, ha_alter_info=0x7f192566c1b0, inplace_supported=HA_ALTER_INPLACE_COPY_LOCK, target_mdl_request=0x7f192566c330, alter_ctx=0x7f192566c8e0) at /data/src/10.3/sql/sql_table.cc:7654
      #9  0x0000556431a24b1f in mysql_alter_table (thd=0x7f18e0000d90, new_db=0x7f18e0005478, new_name=0x7f18e0005840, create_info=0x7f192566d4d0, table_list=0x7f18e00117e8, alter_info=0x7f192566d410, order_num=0, order=0x0, ignore=false) at /data/src/10.3/sql/sql_table.cc:9946
      #10 0x0000556431ab4dac in Sql_cmd_alter_table::execute (this=0x7f18e0011f18, thd=0x7f18e0000d90) at /data/src/10.3/sql/sql_alter.cc:512
      #11 0x0000556431940a69 in mysql_execute_command (thd=0x7f18e0000d90) at /data/src/10.3/sql/sql_parse.cc:6022
      #12 0x00005564319462ce in mysql_parse (thd=0x7f18e0000d90, rawbuf=0x7f18e00116f8 "ALTER TABLE t3 ADD INDEX idx (c)", length=32, parser_state=0x7f192566e5c0, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:7810
      #13 0x0000556431932a8f in dispatch_command (command=COM_QUERY, thd=0x7f18e0000d90, packet=0x7f18e0008f11 "ALTER TABLE t3 ADD INDEX idx (c)", packet_length=32, is_com_multi=false, is_next_command=false) at /data/src/10.3/sql/sql_parse.cc:1847
      #14 0x000055643193142f in do_command (thd=0x7f18e0000d90) at /data/src/10.3/sql/sql_parse.cc:1393
      #15 0x0000556431aaec44 in do_handle_one_connection (connect=0x556433f529c0) at /data/src/10.3/sql/sql_connect.cc:1403
      #16 0x0000556431aae9a0 in handle_one_connection (arg=0x556433f529c0) at /data/src/10.3/sql/sql_connect.cc:1308
      #17 0x0000556432474925 in pfs_spawn_thread (arg=0x5564342e84e0) at /data/src/10.3/storage/perfschema/pfs.cc:1869
      #18 0x00007f1932fb1609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #19 0x00007f1932b8b293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      or

      #10 <signal handler called>
      #11 0x00007f7b8d40199e in myrocks::ha_rocksdb::can_use_bloom_filter (this=0x7f7b540c3e58, thd=0x7f7b54000d50, kd=..., eq_cond=..., use_all_keys=false) at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:13825
      #12 0x00007f7b8d4018cb in myrocks::ha_rocksdb::check_bloom_and_set_bounds (this=0x7f7b540c3e58, thd=0x7f7b54000d50, kd=..., eq_cond=..., use_all_keys=false, bound_len=4, lower_bound=0x7f7b54060970 '\245' <repeats 32 times>, "h4z\025", 
          upper_bound=0x7f7b54070cd0 '\245' <repeats 32 times>, "h4z\025", lower_bound_slice=0x7f7b540c4358, upper_bound_slice=0x7f7b540c4368) at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:13769
      #13 0x00007f7b8d3f46c1 in myrocks::ha_rocksdb::setup_scan_iterator (this=0x7f7b540c3e58, kd=..., slice=0x7f7b8406b540, use_all_keys=false, eq_cond_len=4) at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:10439
      #14 0x00007f7b8d3f0bf6 in myrocks::ha_rocksdb::index_last_intern (this=0x7f7b540c3e58, buf=0x7f7b540f0c60 "\377") at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:9299
      #15 0x00007f7b8d3f05fc in myrocks::ha_rocksdb::index_first (this=0x7f7b540c3e58, buf=0x7f7b540f0c60 "\377") at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:9125
      #16 0x00007f7b8d3fcd46 in myrocks::ha_rocksdb::inplace_populate_sk (this=0x7f7b540c3e58, new_table_arg=0x7f7b540f3aa0, indexes=std::unordered_set with 1 element = {...})
          at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:12746
      #17 0x00007f7b8d3fc7de in myrocks::ha_rocksdb::inplace_alter_table (this=0x7f7b540c3e58, altered_table=0x7f7b540f3aa0, ha_alter_info=0x7f7b8406c190) at /home/mariadb/MDEV-23956/10.3/storage/rocksdb/ha_rocksdb.cc:12634
      #18 0x0000558665c4382b in handler::ha_inplace_alter_table (this=0x7f7b540c3e58, altered_table=0x7f7b540f3aa0, ha_alter_info=0x7f7b8406c190) at /home/mariadb/MDEV-23956/10.3/sql/handler.h:4207
      #19 0x0000558665c37f29 in mysql_inplace_alter_table (thd=0x7f7b54000d50, table_list=0x7f7b54012cb0, table=0x7f7b5405f9b0, altered_table=0x7f7b540f3aa0, ha_alter_info=0x7f7b8406c190, inplace_supported=HA_ALTER_INPLACE_COPY_LOCK, 
          target_mdl_request=0x7f7b8406c310, alter_ctx=0x7f7b8406c8c0) at /home/mariadb/MDEV-23956/10.3/sql/sql_table.cc:7654
      #20 0x0000558665c3e97c in mysql_alter_table (thd=0x7f7b54000d50, new_db=0x7f7b54005438, new_name=0x7f7b54005800, create_info=0x7f7b8406d4b0, table_list=0x7f7b54012cb0, alter_info=0x7f7b8406d3f0, order_num=0, order=0x0, ignore=false)
          at /home/mariadb/MDEV-23956/10.3/sql/sql_table.cc:9946
      #21 0x0000558665ccd633 in Sql_cmd_alter_table::execute (this=0x7f7b540133e0, thd=0x7f7b54000d50) at /home/mariadb/MDEV-23956/10.3/sql/sql_alter.cc:512
      #22 0x0000558665b5d0ed in mysql_execute_command (thd=0x7f7b54000d50) at /home/mariadb/MDEV-23956/10.3/sql/sql_parse.cc:6022
      #23 0x0000558665b628a2 in mysql_parse (thd=0x7f7b54000d50, rawbuf=0x7f7b54012bc0 "ALTER TABLE t3 ADD INDEX idx (c)", length=32, parser_state=0x7f7b8406e5c0, is_com_multi=false, is_next_command=false)
          at /home/mariadb/MDEV-23956/10.3/sql/sql_parse.cc:7810
      #24 0x0000558665b4f0d7 in dispatch_command (command=COM_QUERY, thd=0x7f7b54000d50, packet=0x7f7b54008ed1 "ALTER TABLE t3 ADD INDEX idx (c)", packet_length=32, is_com_multi=false, is_next_command=false)
          at /home/mariadb/MDEV-23956/10.3/sql/sql_parse.cc:1847
      #25 0x0000558665b4d9f1 in do_command (thd=0x7f7b54000d50) at /home/mariadb/MDEV-23956/10.3/sql/sql_parse.cc:1393
      #26 0x0000558665cc763d in do_handle_one_connection (connect=0x558667e72220) at /home/mariadb/MDEV-23956/10.3/sql/sql_connect.cc:1403
      #27 0x0000558665cc739f in handle_one_connection (arg=0x558667e72220) at /home/mariadb/MDEV-23956/10.3/sql/sql_connect.cc:1308
      #28 0x000055866667ec05 in pfs_spawn_thread (arg=0x558667ff9970) at /home/mariadb/MDEV-23956/10.3/storage/perfschema/pfs.cc:1869
      #29 0x00007f7b93a716db in start_thread (arg=0x7f7b8406f700) at pthread_create.c:463
      #30 0x00007f7b92e5ba3f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Reproducible on 10.2-10.5, release and debug builds alike.
      rr profile is available.

      ASAN produces

      10.3 469a249a ASAN debug

      ==1637204==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400002d298 at pc 0x7f651d19e511 bp 0x7f65172f98b0 sp 0x7f65172f98a0
      READ of size 8 at 0x60400002d298 thread T31
          #0 0x7f651d19e510 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/include/c++/9/bits/shared_ptr_base.h:1310
          #1 0x7f651d183dab in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/9/bits/shared_ptr_base.h:1021
          #2 0x7f651d16d5ef in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/9/bits/shared_ptr_base.h:1015
          #3 0x7f651d0f864c in myrocks::ha_rocksdb::index_first(unsigned char*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:9124
          #4 0x7f651d117e37 in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12746
          #5 0x7f651d117156 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12634
          #6 0x5625db54acff in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/sql/handler.h:4207
          #7 0x5625db52e616 in mysql_inplace_alter_table /data/src/10.3/sql/sql_table.cc:7654
          #8 0x5625db53ee44 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9946
          #9 0x5625db6aa07c in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
          #10 0x5625db2f10d2 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6022
          #11 0x5625db2fd6d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810
          #12 0x5625db2d4678 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847
          #13 0x5625db2d11af in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393
          #14 0x5625db6994f0 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #15 0x5625db698daa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #16 0x5625dcca4d8a in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #17 0x7f6526957608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
          #18 0x7f6526533292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      0x60400002d298 is located 8 bytes inside of 40-byte region [0x60400002d290,0x60400002d2b8)
      freed by thread T28 here:
          #0 0x7f6526b588df in operator delete(void*) (/lib/x86_64-linux-gnu/libasan.so.5+0x1108df)
          #1 0x7f651d1a732b in __gnu_cxx::new_allocator<rocksdb::DbPath>::deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/ext/new_allocator.h:128
          #2 0x7f651d18d6a5 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::deallocate(std::allocator<rocksdb::DbPath>&, rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:470
          #3 0x7f651d174a43 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/stl_vector.h:351
          #4 0x7f651d1614fa in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~_Vector_base() /usr/include/c++/9/bits/stl_vector.h:332
          #5 0x7f651d15fdc7 in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~vector() /usr/include/c++/9/bits/stl_vector.h:680
          #6 0x7f651d1372d9 in rocksdb::DBOptions::~DBOptions() /data/src/10.3/storage/rocksdb/rocksdb/include/rocksdb/options.h:350
          #7 0x7f651d31dc42 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /data/src/10.3/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
          #8 0x7f651db15f9f in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /data/src/10.3/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
          #9 0x7f651d24591d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /data/src/10.3/storage/rocksdb/rdb_datadic.cc:581
          #10 0x7f651d0ea1f8 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7516
          #11 0x7f651d0e5b7b in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7107
          #12 0x7f651d0ebb67 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7694
          #13 0x7f651d0ecc29 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7840
          #14 0x5625dba6e7d7 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.3/sql/handler.cc:4734
          #15 0x5625dba72ea6 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /data/src/10.3/sql/handler.cc:5197
          #16 0x5625db61c193 in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /data/src/10.3/sql/unireg.cc:515
          #17 0x5625db51c9a2 in create_table_impl /data/src/10.3/sql/sql_table.cc:5022
          #18 0x5625db51d6b8 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5141
          #19 0x5625db51e17e in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.3/sql/sql_table.cc:5233
          #20 0x5625db549924 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11276
          #21 0x5625db2f10d2 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6022
          #22 0x5625db2fd6d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810
          #23 0x5625db2d4678 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847
          #24 0x5625db2d11af in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393
          #25 0x5625db6994f0 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #26 0x5625db698daa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #27 0x5625dcca4d8a in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #28 0x7f6526957608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
       
      previously allocated by thread T28 here:
          #0 0x7f6526b57947 in operator new(unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0x10f947)
          #1 0x7f651d1cecf4 in __gnu_cxx::new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/include/c++/9/ext/new_allocator.h:114
          #2 0x7f651d1bee2b in std::allocator_traits<std::allocator<rocksdb::DbPath> >::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:444
          #3 0x7f651d1a6705 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate(unsigned long) /usr/include/c++/9/bits/stl_vector.h:343
          #4 0x7f651d2d3e6d in rocksdb::DbPath* std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > > >(unsigned long, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >) /usr/include/c++/9/bits/stl_vector.h:1508
          #5 0x7f651d2d00db in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::operator=(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > const&) /usr/include/c++/9/bits/vector.tcc:226
          #6 0x7f651d85df9b in rocksdb::BuildDBOptions(rocksdb::ImmutableDBOptions const&, rocksdb::MutableDBOptions const&) /data/src/10.3/storage/rocksdb/rocksdb/options/options_helper.cc:52
          #7 0x7f651d31dc12 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /data/src/10.3/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
          #8 0x7f651db15f9f in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /data/src/10.3/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
          #9 0x7f651d24591d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /data/src/10.3/storage/rocksdb/rdb_datadic.cc:581
          #10 0x7f651d0ea1f8 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7516
          #11 0x7f651d0e5b7b in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7107
          #12 0x7f651d0ebb67 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7694
          #13 0x7f651d0ecc29 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:7840
          #14 0x5625dba6e7d7 in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /data/src/10.3/sql/handler.cc:4734
          #15 0x5625dba72ea6 in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*) /data/src/10.3/sql/handler.cc:5197
          #16 0x5625db61c193 in rea_create_table(THD*, st_mysql_const_unsigned_lex_string*, char const*, char const*, char const*, HA_CREATE_INFO*, handler*, bool) /data/src/10.3/sql/unireg.cc:515
          #17 0x5625db51c9a2 in create_table_impl /data/src/10.3/sql/sql_table.cc:5022
          #18 0x5625db51d6b8 in mysql_create_table_no_lock(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /data/src/10.3/sql/sql_table.cc:5141
          #19 0x5625db51e17e in mysql_create_table(THD*, TABLE_LIST*, Table_specification_st*, Alter_info*) /data/src/10.3/sql/sql_table.cc:5233
          #20 0x5625db549924 in Sql_cmd_create_table_like::execute(THD*) /data/src/10.3/sql/sql_table.cc:11276
          #21 0x5625db2f10d2 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6022
          #22 0x5625db2fd6d1 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810
          #23 0x5625db2d4678 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847
          #24 0x5625db2d11af in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393
          #25 0x5625db6994f0 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #26 0x5625db698daa in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #27 0x5625dcca4d8a in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #28 0x7f6526957608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
       
      Thread T31 created by T0 here:
          #0 0x7f6526a82805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x5625dcca517b in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
          #2 0x5625daffd29e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
          #3 0x5625db015c6d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6609
          #4 0x5625db016408 in create_new_thread /data/src/10.3/sql/mysqld.cc:6679
          #5 0x5625db01759a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6937
          #6 0x5625db014f63 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6231
          #7 0x5625daffba9c in main /data/src/10.3/sql/main.cc:25
          #8 0x7f65264380b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      Thread T28 created by T0 here:
          #0 0x7f6526a82805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x5625dcca517b in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
          #2 0x5625daffd29e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
          #3 0x5625db015c6d in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6609
          #4 0x5625db016408 in create_new_thread /data/src/10.3/sql/mysqld.cc:6679
          #5 0x5625db01759a in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6937
          #6 0x5625db014f63 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6231
          #7 0x5625daffba9c in main /data/src/10.3/sql/main.cc:25
          #8 0x7f65264380b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/9/bits/shared_ptr_base.h:1310 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const
      Shadow bytes around the buggy address:
        0x0c087fffda00: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
        0x0c087fffda10: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda20: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda30: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda40: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
      =>0x0c087fffda50: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda70: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffda80: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
        0x0c087fffda90: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
        0x0c087fffdaa0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      ==1637204==ABORTING
      

      or

      10.3 469a249a ASAN non-debug

      ==1637910==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000032318 at pc 0x7f9f574e6fca bp 0x7f9f520659f0 sp 0x7f9f520659e0
      READ of size 8 at 0x604000032318 thread T31
          #0 0x7f9f574e6fc9 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/9/bits/shared_ptr_base.h:1021
          #1 0x7f9f574e6fc9 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/9/bits/shared_ptr_base.h:1015
          #2 0x7f9f574e6fc9 in myrocks::ha_rocksdb::index_first(unsigned char*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:9124
          #3 0x7f9f57528ad7 in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12746
          #4 0x7f9f5752a0de in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/storage/rocksdb/ha_rocksdb.cc:12634
          #5 0x558e50bde9e6 in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /data/src/10.3/sql/handler.h:4207
          #6 0x558e50bde9e6 in mysql_inplace_alter_table /data/src/10.3/sql/sql_table.cc:7654
          #7 0x558e50c095a5 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /data/src/10.3/sql/sql_table.cc:9946
          #8 0x558e50d2cc40 in Sql_cmd_alter_table::execute(THD*) /data/src/10.3/sql/sql_alter.cc:512
          #9 0x558e509c3c86 in mysql_execute_command(THD*) /data/src/10.3/sql/sql_parse.cc:6022
          #10 0x558e509dc3df in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /data/src/10.3/sql/sql_parse.cc:7810
          #11 0x558e509e3026 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /data/src/10.3/sql/sql_parse.cc:1847
          #12 0x558e509e9e0d in do_command(THD*) /data/src/10.3/sql/sql_parse.cc:1393
          #13 0x558e50d227e6 in do_handle_one_connection(CONNECT*) /data/src/10.3/sql/sql_connect.cc:1403
          #14 0x558e50d2306e in handle_one_connection /data/src/10.3/sql/sql_connect.cc:1308
          #15 0x558e5209bc98 in pfs_spawn_thread /data/src/10.3/storage/perfschema/pfs.cc:1869
          #16 0x7f9f60932608 in start_thread /build/glibc-ZN95T4/glibc-2.31/nptl/pthread_create.c:477
          #17 0x7f9f6050e292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
       
      Address 0x604000032318 is a wild pointer.
      SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/include/c++/9/bits/shared_ptr_base.h:1021 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const
      Shadow bytes around the buggy address:
        0x0c087fffe410: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
        0x0c087fffe420: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00
        0x0c087fffe430: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe440: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe450: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      =>0x0c087fffe460: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe470: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe480: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe490: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe4a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
        0x0c087fffe4b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      Shadow byte legend (one shadow byte represents 8 application bytes):
        Addressable:           00
        Partially addressable: 01 02 03 04 05 06 07 
        Heap left redzone:       fa
        Freed heap region:       fd
        Stack left redzone:      f1
        Stack mid redzone:       f2
        Stack right redzone:     f3
        Stack after return:      f5
        Stack use after scope:   f8
        Global redzone:          f9
        Global init order:       f6
        Poisoned by user:        f7
        Container overflow:      fc
        Array cookie:            ac
        Intra object redzone:    bb
        ASan internal:           fe
        Left alloca redzone:     ca
        Right alloca redzone:    cb
        Shadow gap:              cc
      Thread T31 created by T0 here:
          #0 0x7f9f60a5d805 in pthread_create (/lib/x86_64-linux-gnu/libasan.so.5+0x3a805)
          #1 0x558e520a37ee in spawn_thread_v1 /data/src/10.3/storage/perfschema/pfs.cc:1919
          #2 0x558e5075a93e in inline_mysql_thread_create /data/src/10.3/include/mysql/psi/mysql_thread.h:1275
          #3 0x558e5075a93e in create_thread_to_handle_connection(CONNECT*) /data/src/10.3/sql/mysqld.cc:6609
          #4 0x558e5076b2d5 in create_new_thread /data/src/10.3/sql/mysqld.cc:6679
          #5 0x558e5076b2d5 in handle_connections_sockets() /data/src/10.3/sql/mysqld.cc:6937
          #6 0x558e5076d265 in mysqld_main(int, char**) /data/src/10.3/sql/mysqld.cc:6231
          #7 0x7f9f604130b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
       
      ==1637910==ABORTING
      

      Here is the non-deterministic MTR test which I use to reproduce the failure. Its efficiency depends a lot on the environment/machine – I get the crash nearly every time on one machine, and only once in dozens of attempts on another, on the same branch with the same build options.

      # Run with --mem  --mysqld=--plugin-load-add=ha_rocksdb --repeat=N
       
      CREATE TABLE t1 (a INT) ENGINE=RocksDB;
      INSERT INTO t1 VALUES (1);
       
      CREATE TABLE t2 (b VARCHAR(1024)) ENGINE=RocksDB;
       
      CREATE TABLE t3 (pk INT, c INT, d VARCHAR(10), PRIMARY KEY(pk), KEY(d)) ENGINE=RocksDB;
       
      --connect (con1,localhost,root,,test)
      SET max_statement_time= 1;
      --send
        ALTER TABLE t2 ADD INDEX idx (b(37));
       
      --connect (con2,localhost,root,,test)
      CREATE PROCEDURE sp() CREATE TABLE tx (f INT);
      CALL sp;
       
      --connect (con3,localhost,root,,test)
      SET max_statement_time= 1;
      --send
        ALTER TABLE t3 ADD INDEX idx (c);
       
      --connection con2
      START TRANSACTION;
      --error ER_BAD_FIELD_ERROR
      SELECT x FROM t1 JOIN t2 JOIN t3;
       
      --connection con1
      --error 0,ER_STATEMENT_TIMEOUT
      --reap
      --connection con2
      --error 0,ER_CANT_DROP_FIELD_OR_KEY,ER_STATEMENT_TIMEOUT
      DROP INDEX idx ON t3;
       
      --connection con3
      --error 0,ER_STATEMENT_TIMEOUT
      --reap
       
      # Cleanup
      --disconnect con1
      --disconnect con2
      --disconnect con3
      --connection default
      DROP PROCEDURE sp;
      DROP TABLE t1, t2, t3, tx;
      

      Attachments

        Issue Links

          Activity

            alice Alice Sherepa added a comment -

            also reproducible as :

            ./mtr  --mysqld=--default-storage-engine=rocksdb  --mysqld=--plugin-load='ha_rocksdb.so' rpl.rpl_killed_ddl
            

            10.3 0e9a255ec87add182f40d4c67d

            =================================================================
            ==920925==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400002f518 at pc 0x7f0aa7faac4f bp 0x7f0aa1f3b520 sp 0x7f0aa1f3b510
            READ of size 8 at 0x60400002f518 thread T34
                #0 0x7f0aa7faac4e in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/include/c++/9/bits/shared_ptr_base.h:1310
                #1 0x7f0aa7f90561 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/9/bits/shared_ptr_base.h:1021
                #2 0x7f0aa7f79da5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/9/bits/shared_ptr_base.h:1015
                #3 0x7f0aa7f04f52 in myrocks::ha_rocksdb::index_first(unsigned char*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:9170
                #4 0x7f0aa7f24757 in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12798
                #5 0x7f0aa7f23a76 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12686
                #6 0x5591ade2ba39 in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.h:4147
                #7 0x5591ade0eaa8 in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7773
                #8 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111
                #9 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147
                #10 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870
                #11 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
                #12 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
                #13 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
                #14 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
                #15 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
                #16 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
                #17 0x7f0ab1356132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)
             
            0x60400002f518 is located 8 bytes inside of 40-byte region [0x60400002f510,0x60400002f538)
            freed by thread T33 here:
                #0 0x7f0ab1d8651f in operator delete(void*) ../../../../src/libsanitizer/asan/asan_new_delete.cc:165
                #1 0x7f0aa7fb3a81 in __gnu_cxx::new_allocator<rocksdb::DbPath>::deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/ext/new_allocator.h:128
                #2 0x7f0aa7f99de3 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::deallocate(std::allocator<rocksdb::DbPath>&, rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:469
                #3 0x7f0aa7f811f9 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/stl_vector.h:351
                #4 0x7f0aa7f6dcb0 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~_Vector_base() /usr/include/c++/9/bits/stl_vector.h:332
                #5 0x7f0aa7f6c57d in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~vector() /usr/include/c++/9/bits/stl_vector.h:680
                #6 0x7f0aa7f43a8f in rocksdb::DBOptions::~DBOptions() (/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/plugins/ha_rocksdb.so+0xd2ba8f)
                #7 0x7f0aa812a406 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
                #8 0x7f0aa892446b in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
                #9 0x7f0aa805209d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /10.3/src/storage/rocksdb/rdb_datadic.cc:581
                #10 0x7f0aa7ef6b24 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7562
                #11 0x7f0aa7ef444d in myrocks::ha_rocksdb::create_inplace_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*, std::array<myrocks::ha_rocksdb::key_def_cf_info, 65ul> const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7352
                #12 0x7f0aa7ef2587 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7164
                #13 0x7f0aa7f22657 in myrocks::ha_rocksdb::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12544
                #14 0x5591ae359a37 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.cc:4598
                #15 0x5591ade0e70e in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7736
                #16 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111
                #17 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147
                #18 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870
                #19 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
                #20 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
                #21 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
                #22 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
                #23 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
                #24 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
             
            previously allocated by thread T33 here:
                #0 0x7f0ab1d85587 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:104
                #1 0x7f0aa7fdb498 in __gnu_cxx::new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/include/c++/9/ext/new_allocator.h:114
                #2 0x7f0aa7fcb5d5 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:443
                #3 0x7f0aa7fb2e5b in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate(unsigned long) /usr/include/c++/9/bits/stl_vector.h:343
                #4 0x7f0aa80e0631 in rocksdb::DbPath* std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > > >(unsigned long, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >) /usr/include/c++/9/bits/stl_vector.h:1508
                #5 0x7f0aa80dc89f in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::operator=(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > const&) /usr/include/c++/9/bits/vector.tcc:226
                #6 0x7f0aa866a77f in rocksdb::BuildDBOptions(rocksdb::ImmutableDBOptions const&, rocksdb::MutableDBOptions const&) /10.3/src/storage/rocksdb/rocksdb/options/options_helper.cc:52
                #7 0x7f0aa812a3d6 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
                #8 0x7f0aa892446b in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
                #9 0x7f0aa805209d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /10.3/src/storage/rocksdb/rdb_datadic.cc:581
                #10 0x7f0aa7ef6b24 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7562
                #11 0x7f0aa7ef444d in myrocks::ha_rocksdb::create_inplace_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*, std::array<myrocks::ha_rocksdb::key_def_cf_info, 65ul> const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7352
                #12 0x7f0aa7ef2587 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7164
                #13 0x7f0aa7f22657 in myrocks::ha_rocksdb::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12544
                #14 0x5591ae359a37 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.cc:4598
                #15 0x5591ade0e70e in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7736
                #16 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111
                #17 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147
                #18 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870
                #19 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852
                #20 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398
                #21 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403
                #22 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308
                #23 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869
                #24 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477
             
            Thread T34 created by T0 here:
                #0 0x7f0ab1cb0815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
                #1 0x5591af5ac07b in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919
                #2 0x5591ad8d039e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275
                #3 0x5591ad8e9158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668
                #4 0x5591ad8e98f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738
                #5 0x5591ad8eaa85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996
                #6 0x5591ad8e8449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290
                #7 0x5591ad8ceb9c in main /10.3/src/sql/main.cc:25
                #8 0x7f0ab125b082 in __libc_start_main ../csu/libc-start.c:308
             
            Thread T33 created by T0 here:
                #0 0x7f0ab1cb0815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
                #1 0x5591af5ac07b in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919
                #2 0x5591ad8d039e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275
                #3 0x5591ad8e9158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668
                #4 0x5591ad8e98f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738
                #5 0x5591ad8eaa85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996
                #6 0x5591ad8e8449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290
                #7 0x5591ad8ceb9c in main /10.3/src/sql/main.cc:25
                #8 0x7f0ab125b082 in __libc_start_main ../csu/libc-start.c:308
             
            SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/9/bits/shared_ptr_base.h:1310 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const
            Shadow bytes around the buggy address:
              0x0c087fffde50: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
              0x0c087fffde60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffde70: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffde80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffde90: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
            =>0x0c087fffdea0: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffdeb0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffdec0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffded0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffdee0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffdef0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Container overflow:      fc
              Array cookie:            ac
              Intra object redzone:    bb
              ASan internal:           fe
              Left alloca redzone:     ca
              Right alloca redzone:    cb
              Shadow gap:              cc
            ==920925==ABORTING
            ----------SERVER LOG END-------------
            

            alice Alice Sherepa added a comment - also reproducible as : ./mtr --mysqld=--default-storage-engine=rocksdb --mysqld=--plugin-load='ha_rocksdb.so' rpl.rpl_killed_ddl 10.3 0e9a255ec87add182f40d4c67d ================================================================= ==920925==ERROR: AddressSanitizer: heap-use-after-free on address 0x60400002f518 at pc 0x7f0aa7faac4f bp 0x7f0aa1f3b520 sp 0x7f0aa1f3b510 READ of size 8 at 0x60400002f518 thread T34 #0 0x7f0aa7faac4e in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/include/c++/9/bits/shared_ptr_base.h:1310 #1 0x7f0aa7f90561 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/9/bits/shared_ptr_base.h:1021 #2 0x7f0aa7f79da5 in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/9/bits/shared_ptr_base.h:1015 #3 0x7f0aa7f04f52 in myrocks::ha_rocksdb::index_first(unsigned char*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:9170 #4 0x7f0aa7f24757 in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12798 #5 0x7f0aa7f23a76 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12686 #6 0x5591ade2ba39 in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.h:4147 #7 0x5591ade0eaa8 in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7773 #8 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111 #9 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147 #10 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870 #11 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852 #12 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398 #13 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403 #14 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308 #15 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869 #16 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477 #17 0x7f0ab1356132 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f132)   0x60400002f518 is located 8 bytes inside of 40-byte region [0x60400002f510,0x60400002f538) freed by thread T33 here: #0 0x7f0ab1d8651f in operator delete(void*) ../../../../src/libsanitizer/asan/asan_new_delete.cc:165 #1 0x7f0aa7fb3a81 in __gnu_cxx::new_allocator<rocksdb::DbPath>::deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/ext/new_allocator.h:128 #2 0x7f0aa7f99de3 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::deallocate(std::allocator<rocksdb::DbPath>&, rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:469 #3 0x7f0aa7f811f9 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/9/bits/stl_vector.h:351 #4 0x7f0aa7f6dcb0 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~_Vector_base() /usr/include/c++/9/bits/stl_vector.h:332 #5 0x7f0aa7f6c57d in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~vector() /usr/include/c++/9/bits/stl_vector.h:680 #6 0x7f0aa7f43a8f in rocksdb::DBOptions::~DBOptions() (/home/alice/am/_depot/m-branch/m3-10.3-bld/mysql-test/var/plugins/ha_rocksdb.so+0xd2ba8f) #7 0x7f0aa812a406 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779 #8 0x7f0aa892446b in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308 #9 0x7f0aa805209d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /10.3/src/storage/rocksdb/rdb_datadic.cc:581 #10 0x7f0aa7ef6b24 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7562 #11 0x7f0aa7ef444d in myrocks::ha_rocksdb::create_inplace_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*, std::array<myrocks::ha_rocksdb::key_def_cf_info, 65ul> const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7352 #12 0x7f0aa7ef2587 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7164 #13 0x7f0aa7f22657 in myrocks::ha_rocksdb::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12544 #14 0x5591ae359a37 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.cc:4598 #15 0x5591ade0e70e in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7736 #16 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111 #17 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147 #18 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870 #19 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852 #20 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398 #21 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403 #22 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308 #23 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869 #24 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477   previously allocated by thread T33 here: #0 0x7f0ab1d85587 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cc:104 #1 0x7f0aa7fdb498 in __gnu_cxx::new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/include/c++/9/ext/new_allocator.h:114 #2 0x7f0aa7fcb5d5 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/include/c++/9/bits/alloc_traits.h:443 #3 0x7f0aa7fb2e5b in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate(unsigned long) /usr/include/c++/9/bits/stl_vector.h:343 #4 0x7f0aa80e0631 in rocksdb::DbPath* std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > > >(unsigned long, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >) /usr/include/c++/9/bits/stl_vector.h:1508 #5 0x7f0aa80dc89f in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::operator=(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > const&) /usr/include/c++/9/bits/vector.tcc:226 #6 0x7f0aa866a77f in rocksdb::BuildDBOptions(rocksdb::ImmutableDBOptions const&, rocksdb::MutableDBOptions const&) /10.3/src/storage/rocksdb/rocksdb/options/options_helper.cc:52 #7 0x7f0aa812a3d6 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779 #8 0x7f0aa892446b in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /10.3/src/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308 #9 0x7f0aa805209d in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /10.3/src/storage/rocksdb/rdb_datadic.cc:581 #10 0x7f0aa7ef6b24 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7562 #11 0x7f0aa7ef444d in myrocks::ha_rocksdb::create_inplace_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*, std::array<myrocks::ha_rocksdb::key_def_cf_info, 65ul> const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7352 #12 0x7f0aa7ef2587 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /10.3/src/storage/rocksdb/ha_rocksdb.cc:7164 #13 0x7f0aa7f22657 in myrocks::ha_rocksdb::prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/storage/rocksdb/ha_rocksdb.cc:12544 #14 0x5591ae359a37 in handler::ha_prepare_inplace_alter_table(TABLE*, Alter_inplace_info*) /10.3/src/sql/handler.cc:4598 #15 0x5591ade0e70e in mysql_inplace_alter_table /10.3/src/sql/sql_table.cc:7736 #16 0x5591ade1faa3 in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, HA_CREATE_INFO*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool) /10.3/src/sql/sql_table.cc:10111 #17 0x5591adbbc856 in mysql_execute_command(THD*) /10.3/src/sql/sql_parse.cc:4147 #18 0x5591adbd6f11 in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.3/src/sql/sql_parse.cc:7870 #19 0x5591adbaddee in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.3/src/sql/sql_parse.cc:1852 #20 0x5591adbaa931 in do_command(THD*) /10.3/src/sql/sql_parse.cc:1398 #21 0x5591adf7df68 in do_handle_one_connection(CONNECT*) /10.3/src/sql/sql_connect.cc:1403 #22 0x5591adf7d822 in handle_one_connection /10.3/src/sql/sql_connect.cc:1308 #23 0x5591af5abc8a in pfs_spawn_thread /10.3/src/storage/perfschema/pfs.cc:1869 #24 0x7f0ab1431608 in start_thread /build/glibc-SzIz7B/glibc-2.31/nptl/pthread_create.c:477   Thread T34 created by T0 here: #0 0x7f0ab1cb0815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x5591af5ac07b in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919 #2 0x5591ad8d039e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275 #3 0x5591ad8e9158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668 #4 0x5591ad8e98f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738 #5 0x5591ad8eaa85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996 #6 0x5591ad8e8449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290 #7 0x5591ad8ceb9c in main /10.3/src/sql/main.cc:25 #8 0x7f0ab125b082 in __libc_start_main ../csu/libc-start.c:308   Thread T33 created by T0 here: #0 0x7f0ab1cb0815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x5591af5ac07b in spawn_thread_v1 /10.3/src/storage/perfschema/pfs.cc:1919 #2 0x5591ad8d039e in inline_mysql_thread_create /10.3/src/include/mysql/psi/mysql_thread.h:1275 #3 0x5591ad8e9158 in create_thread_to_handle_connection(CONNECT*) /10.3/src/sql/mysqld.cc:6668 #4 0x5591ad8e98f3 in create_new_thread /10.3/src/sql/mysqld.cc:6738 #5 0x5591ad8eaa85 in handle_connections_sockets() /10.3/src/sql/mysqld.cc:6996 #6 0x5591ad8e8449 in mysqld_main(int, char**) /10.3/src/sql/mysqld.cc:6290 #7 0x5591ad8ceb9c in main /10.3/src/sql/main.cc:25 #8 0x7f0ab125b082 in __libc_start_main ../csu/libc-start.c:308   SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/9/bits/shared_ptr_base.h:1310 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const Shadow bytes around the buggy address: 0x0c087fffde50: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa 0x0c087fffde60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffde70: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffde80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffde90: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa =>0x0c087fffdea0: fa fa fd[fd]fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffdeb0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffdec0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffded0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffdee0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffdef0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==920925==ABORTING ----------SERVER LOG END-------------
            Roel Roel Van de Paar added a comment - - edited

            I also ran into this. May be lightly sporadic

            SET max_statement_time=0.1;
            INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so';
            SET SESSION default_storage_engine='RocksDB';
            CREATE TABLE t (c INT,c2 CHAR(1),c3 INT(1),c4 VARCHAR(1) KEY,c5 INT UNIQUE KEY,c6 DECIMAL(0,0) DEFAULT 3.1);
            --error ER_NO_TABLES_USED
            SELECT *;
            CREATE INDEX t_c2_idx ON t (c2);
            

            Leads to:

            11.0.1 f2dc4d4c10ac36a73b5c1eb765352d3aee808d66 (Debug)

            Core was generated by `/test/MD180223-mariadb-11.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x000015093d75784f in myrocks::ha_rocksdb::index_first (
                this=0x1508f40828f0, buf=0x1508f4279b88 <incomplete sequence \357>)
                at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:9220
            9220	               ? index_last_intern(buf)
            [Current thread is 1 (Thread 0x15093dc1a640 (LWP 2879915))]
            (gdb) bt
            #0  0x000015093d75784f in myrocks::ha_rocksdb::index_first (this=0x1508f40828f0, buf=0x1508f4279b88 <incomplete sequence \357>) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:9220
            #1  0x000015093d7660e2 in myrocks::ha_rocksdb::inplace_populate_sk (this=this@entry=0x1508f40828f0, new_table_arg=new_table_arg@entry=0x15093dc169f0, indexes=std::unordered_set with 1 element = {
                  [0] = std::shared_ptr<myrocks::Rdb_key_def> (use count 3, weak count 0) = {
                    get() = 0x1508f426f720
                  }
                }) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:12857
            #2  0x000015093d766898 in myrocks::ha_rocksdb::inplace_alter_table (this=0x1508f40828f0, altered_table=0x15093dc169f0, ha_alter_info=0x15093dc16930) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:12745
            #3  0x000055efd0a55564 in handler::ha_inplace_alter_table (ha_alter_info=0x15093dc16930, altered_table=0x15093dc169f0, this=<optimized out>) at /test/11.0_dbg/sql/handler.h:4823
            #4  mysql_inplace_alter_table (thd=thd@entry=0x1508f4000d58, table_list=0x1508f4013230, table=table@entry=0x1508f4007ed8, altered_table=altered_table@entry=0x15093dc169f0, ha_alter_info=ha_alter_info@entry=0x15093dc16930, target_mdl_request=target_mdl_request@entry=0x15093dc171d0, ddl_log_state=0x15093dc168c0, trigger_param=0x15093dc16db0, alter_ctx=0x15093dc180b0, partial_alter=@0x15093dc1682f: false, start_alter_id=@0x15093dc16838: 0, if_exists=false) at /test/11.0_dbg/sql/sql_table.cc:7681
            #5  0x000055efd0a677fb in mysql_alter_table (thd=thd@entry=0x1508f4000d58, new_db=new_db@entry=0x1508f4013248, new_name=new_name@entry=0x1508f4013258, create_info=create_info@entry=0x15093dc18f00, table_list=<optimized out>, table_list@entry=0x1508f4013230, recreate_info=recreate_info@entry=0x15093dc18e00, alter_info=<optimized out>, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/11.0_dbg/sql/sql_table.cc:10783
            #6  0x000055efd0985101 in mysql_execute_command (thd=thd@entry=0x1508f4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.0_dbg/sql/sql_parse.cc:4214
            #7  0x000055efd098b7cf in mysql_parse (thd=thd@entry=0x1508f4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15093dc192c0) at /test/11.0_dbg/sql/sql_parse.cc:8002
            #8  0x000055efd098d963 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1508f4000d58, packet=packet@entry=0x1508f400ae19 "CREATE INDEX t_c2_idx ON t (c2)", packet_length=packet_length@entry=31, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_class.h:242
            #9  0x000055efd098f7bc in do_command (thd=0x1508f4000d58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_parse.cc:1407
            #10 0x000055efd0ae06e2 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55efd318d8a8, put_in_cache=put_in_cache@entry=true) at /test/11.0_dbg/sql/sql_connect.cc:1416
            #11 0x000055efd0ae0941 in handle_one_connection (arg=0x55efd318d8a8) at /test/11.0_dbg/sql/sql_connect.cc:1318
            #12 0x0000150956ce0b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
            #13 0x0000150956d72a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
            

            10.7.8 bc656c4fa54c12ceabd857e8ae134f8979d82944 (Debug)

            Core was generated by `/test/MD110223-mariadb-10.7.8-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x000014e65176ca77 in myrocks::ha_rocksdb::can_use_bloom_filter (
                this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=..., eq_cond=..., 
                use_all_keys=use_all_keys@entry=false)
                at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13925
            [Current thread is 1 (Thread 0x14e651c34640 (LWP 2879882))]
            (gdb) bt
            #0  0x000014e65176ca77 in myrocks::ha_rocksdb::can_use_bloom_filter (this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, eq_cond=@0x14e651c2fc10: {data_ = 0x14e61c22e578 "Q\272Z襥", '\245' <repeats 18 times>, size_ = 4}, use_all_keys=use_all_keys@entry=false) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13925
            #1  0x000014e65176caba in myrocks::ha_rocksdb::check_bloom_and_set_bounds (this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, eq_cond=@0x14e651c2fc10: {data_ = 0x14e61c22e578 "Q\272Z襥", '\245' <repeats 18 times>, size_ = 4}, use_all_keys=use_all_keys@entry=false, bound_len=bound_len@entry=4, lower_bound=0x14e61c086338 '\245' <repeats 24 times>, "\n\243\060_3Vw$%\020", upper_bound=0x14e61c24e7c8 '\245' <repeats 24 times>, "@", lower_bound_slice=0x14e61c082460, upper_bound_slice=0x14e61c082470) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13869
            #2  0x000014e651772aa4 in myrocks::ha_rocksdb::setup_scan_iterator (this=this@entry=0x14e61c081ed0, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, slice=slice@entry=0x14e651c2fcf0, use_all_keys=use_all_keys@entry=false, eq_cond_len=eq_cond_len@entry=4) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:10509
            #3  0x000014e6517795fd in myrocks::ha_rocksdb::index_last_intern (this=0x14e61c081ed0, buf=0x14e61c24d3b8 <incomplete sequence \357>) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:9369
            #4  0x000014e6517797ea in myrocks::ha_rocksdb::index_first (this=<optimized out>, buf=<optimized out>) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:9195
            #5  0x000014e65178803a in myrocks::ha_rocksdb::inplace_populate_sk (this=this@entry=0x14e61c081ed0, new_table_arg=new_table_arg@entry=0x14e651c30a70, indexes=std::unordered_set with 1 element = {
                  [0] = std::shared_ptr<myrocks::Rdb_key_def> (use count 3, weak count 0) = {
                    get() = 0x14e61c26dbc0
                  }
                }) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:12832
            #6  0x000014e6517887f0 in myrocks::ha_rocksdb::inplace_alter_table (this=0x14e61c081ed0, altered_table=0x14e651c30a70, ha_alter_info=0x14e651c309b0) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:12720
            #7  0x0000560c5c4843de in handler::ha_inplace_alter_table (ha_alter_info=0x14e651c309b0, altered_table=0x14e651c30a70, this=<optimized out>) at /test/10.7_dbg/sql/handler.h:4607
            #8  mysql_inplace_alter_table (thd=thd@entry=0x14e61c000d58, table_list=0x14e61c0131c0, table=table@entry=0x14e61c272668, altered_table=altered_table@entry=0x14e651c30a70, ha_alter_info=ha_alter_info@entry=0x14e651c309b0, target_mdl_request=target_mdl_request@entry=0x14e651c31240, ddl_log_state=0x14e651c30940, trigger_param=0x14e651c30e30, alter_ctx=0x14e651c32110) at /test/10.7_dbg/sql/sql_table.cc:7522
            #9  0x0000560c5c49604f in mysql_alter_table (thd=thd@entry=0x14e61c000d58, new_db=new_db@entry=0x14e61c0131d8, new_name=new_name@entry=0x14e61c0131e8, create_info=create_info@entry=0x14e651c32f50, table_list=<optimized out>, table_list@entry=0x14e61c0131c0, recreate_info=recreate_info@entry=0x14e651c32e50, alter_info=<optimized out>, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/10.7_dbg/sql/sql_table.cc:10454
            #10 0x0000560c5c3bc78a in mysql_execute_command (thd=thd@entry=0x14e61c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:4213
            #11 0x0000560c5c3c2dc2 in mysql_parse (thd=thd@entry=0x14e61c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e651c332d0) at /test/10.7_dbg/sql/sql_parse.cc:8019
            #12 0x0000560c5c3c4f56 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e61c000d58, packet=packet@entry=0x14e61c00ada9 "CREATE INDEX t_c2_idx ON t (c2)", packet_length=packet_length@entry=31, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:240
            #13 0x0000560c5c3c6daf in do_command (thd=0x14e61c000d58, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1407
            #14 0x0000560c5c50cfea in do_handle_one_connection (connect=<optimized out>, connect@entry=0x560c5f835858, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1416
            #15 0x0000560c5c50d249 in handle_one_connection (arg=0x560c5f835858) at /test/10.7_dbg/sql/sql_connect.cc:1318
            #16 0x000014e66a736b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
            #17 0x000014e66a7c8a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
            

            10.5.20 c41c79650aa2ef8eaf3f887b94db8cc7478eadd1 (Optimized)

            Core was generated by `/test/MD110223-mariadb-10.5.20-linux-x86_64-opt/bin/mariadbd --no-defaults --co'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  rocksdb::DBImpl::NewIterator (this=0x148828209460, read_options=..., 
                column_family=0x1000001488282601)
                at /test/10.5_opt/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2482
            [Current thread is 1 (Thread 0x1488940d7640 (LWP 2879868))]
            (gdb) bt
            #0  rocksdb::DBImpl::NewIterator (this=0x148828209460, read_options=@0x1488940d3110: {snapshot = 0x1488282c2150, iterate_lower_bound = 0x1488282caf20, iterate_upper_bound = 0x1488282caf30, readahead_size = 0, max_skippable_internal_keys = 0, read_tier = rocksdb::kReadAllTier, verify_checksums = true, fill_cache = true, tailing = false, managed = false, total_order_seek = true, auto_prefix_mode = false, prefix_same_as_start = false, pin_data = false, background_purge_on_iterator_cleanup = false, ignore_range_deletions = false, table_filter = {<std::_Maybe_unary_or_binary_function<bool, rocksdb::TableProperties const&>> = {<std::unary_function<rocksdb::TableProperties const&, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x0, _M_const_object = 0x0, _M_function_pointer = 0x0, _M_member_pointer = NULL}, _M_pod_data = '\000' <repeats 15 times>}, _M_manager = 0x0}, _M_invoker = 0x0}, iter_start_seqnum = 0, timestamp = 0x0}, column_family=0x1000001488282601) at /test/10.5_opt/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2482
            #1  0x0000148884cb6568 in rocksdb::TransactionBaseImpl::GetIterator (this=0x148828237a70, read_options=@0x1488940d3110: {snapshot = 0x1488282c2150, iterate_lower_bound = 0x1488282caf20, iterate_upper_bound = 0x1488282caf30, readahead_size = 0, max_skippable_internal_keys = 0, read_tier = rocksdb::kReadAllTier, verify_checksums = true, fill_cache = true, tailing = false, managed = false, total_order_seek = true, auto_prefix_mode = false, prefix_same_as_start = false, pin_data = false, background_purge_on_iterator_cleanup = false, ignore_range_deletions = false, table_filter = {<std::_Maybe_unary_or_binary_function<bool, rocksdb::TableProperties const&>> = {<std::unary_function<rocksdb::TableProperties const&, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x0, _M_const_object = 0x0, _M_function_pointer = 0x0, _M_member_pointer = NULL}, _M_pod_data = '\000' <repeats 15 times>}, _M_manager = 0x0}, _M_invoker = 0x0}, iter_start_seqnum = 0, timestamp = 0x0}, column_family=0x1000001488282601) at /test/10.5_opt/storage/rocksdb/rocksdb/utilities/transactions/transaction_base.cc:369
            #2  0x000014888491f1cd in myrocks::Rdb_transaction::get_iterator (create_snapshot=true, read_current=false, eq_cond_upper_bound=@0x1488282caf30: {data_ = 0x148828262bc8 "\210(&\a\210\024", size_ = 4}, eq_cond_lower_bound=@0x1488282caf20: {data_ = 0x148828007728 "\210(&\006eforePrepareWrite", size_ = 4}, fill_cache=true, skip_bloom_filter=true, column_family=0x1000001488282601, this=0x14882823c730) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:3011
            #3  myrocks::ha_rocksdb::setup_scan_iterator (this=0x1488282ca990, kd=<optimized out>, slice=<optimized out>, use_all_keys=<optimized out>, eq_cond_len=<optimized out>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:10551
            #4  0x00001488849200fe in myrocks::ha_rocksdb::index_first_intern (this=this@entry=0x1488282ca990, buf=0x14882825ebf8 <incomplete sequence \357>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:9274
            #5  0x00001488849314be in myrocks::ha_rocksdb::index_first (buf=<optimized out>, this=0x1488282ca990) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:9193
            #6  myrocks::ha_rocksdb::inplace_populate_sk (this=0x1488282ca990, new_table_arg=0x1488940d36c0, indexes=<optimized out>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:12824
            #7  0x0000148884931aef in myrocks::ha_rocksdb::inplace_alter_table (this=0x1488282ca990, altered_table=0x1488940d36c0, ha_alter_info=0x1488940d3620) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:12712
            #8  0x00005608a66698f5 in handler::ha_inplace_alter_table (ha_alter_info=0x1488940d3620, altered_table=0x1488940d36c0, this=<optimized out>) at /test/10.5_opt/sql/handler.h:4520
            #9  mysql_inplace_alter_table (target_mdl_request=0x1488940d3ac0, alter_ctx=0x1488940d4e20, ha_alter_info=0x1488940d3620, altered_table=0x1488940d36c0, table=0x148828211408, table_list=0x148828010540, thd=0x148828000c68) at /test/10.5_opt/sql/sql_table.cc:8159
            #10 mysql_alter_table (thd=thd@entry=0x148828000c68, new_db=new_db@entry=0x148828010558, new_name=new_name@entry=0x148828010568, create_info=create_info@entry=0x1488940d5ab0, table_list=<optimized out>, table_list@entry=0x148828010540, recreate_info=recreate_info@entry=0x1488940d59b0, alter_info=0x1488940d59e0, order_num=0, order=0x0, ignore=false, if_exists=false) at /test/10.5_opt/sql/sql_table.cc:10879
            #11 0x00005608a65c0478 in mysql_execute_command (thd=0x148828000c68) at /test/10.5_opt/sql/sql_parse.cc:4274
            #12 0x00005608a65c4522 in mysql_parse (thd=0x148828000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:8091
            #13 0x00005608a65c69ca in dispatch_command (command=COM_QUERY, thd=0x148828000c68, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:1990
            #14 0x00005608a65c8be0 in do_command (thd=0x148828000c68) at /test/10.5_opt/sql/sql_parse.cc:1375
            #15 0x00005608a66c27d6 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5608a86a2538, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1416
            #16 0x00005608a66c2a7d in handle_one_connection (arg=0x5608a86a2538) at /test/10.5_opt/sql/sql_connect.cc:1318
            #17 0x000014889ebbdb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
            #18 0x000014889ec4fa00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
            

            11.0.1 4d09050ca77a7efac4565d46e4bcd85a5f210c53 (Optimized, UBASAN)

            =================================================================
            ==3194184==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000350d8 at pc 0x154d76a7c34e bp 0x154d7d6b56d0 sp 0x154d7d6b56c0
            READ of size 8 at 0x6040000350d8 thread T15
                #0 0x154d76a7c34d in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/include/c++/11/bits/shared_ptr_base.h:1296
                #1 0x154d76a7c34d in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/11/bits/shared_ptr_base.h:993
                #2 0x154d76a7c34d in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/11/bits/shared_ptr_base.h:987
                #3 0x154d76a7c34d in myrocks::ha_rocksdb::index_first(unsigned char*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:9200
                #4 0x154d76aee4ce in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:12838
                #5 0x154d76af1da1 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:12726
                #6 0x558b07d2bb3d in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /test/11.0_opt_san/sql/handler.h:4588
                #7 0x558b07d2bb3d in mysql_inplace_alter_table /test/11.0_opt_san/sql/sql_table.cc:7680
                #8 0x558b07d2bb3d in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /test/11.0_opt_san/sql/sql_table.cc:10781
                #9 0x558b076f87cb in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:4213
                #10 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000
                #11 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894
                #12 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407
                #13 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416
                #14 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318
                #15 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442
                #16 0x154d9fa3c9ff  (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)
             
            0x6040000350d8 is located 8 bytes inside of 40-byte region [0x6040000350d0,0x6040000350f8)
            freed by thread T15 here:
                #0 0x558b06e4ccb7 in operator delete(void*) (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x790bcb7)
                #1 0x154d76b760bd in __gnu_cxx::new_allocator<rocksdb::DbPath>::deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/11/ext/new_allocator.h:145
                #2 0x154d76b760bd in std::allocator_traits<std::allocator<rocksdb::DbPath> >::deallocate(std::allocator<rocksdb::DbPath>&, rocksdb::DbPath*, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:496
                #3 0x154d76b760bd in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/11/bits/stl_vector.h:354
                #4 0x154d76b760bd in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~_Vector_base() /usr/include/c++/11/bits/stl_vector.h:335
                #5 0x154d76b760bd in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~vector() /usr/include/c++/11/bits/stl_vector.h:683
                #6 0x154d76b760bd in rocksdb::DBOptions::~DBOptions() /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:350
                #7 0x154d76eba2f6 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
                #8 0x154d76d397f6 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
                #9 0x154d76d397f6 in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/11.0_opt_san/storage/rocksdb/rdb_datadic.cc:591
                #10 0x154d76a45769 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7590
                #11 0x154d76abde30 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7181
                #12 0x154d76abee74 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7767
                #13 0x154d76ac0ca9 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7914
                #14 0x558b08bc668e in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/sql/handler.cc:5465
                #15 0x558b08bcb0ef in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/11.0_opt_san/sql/handler.cc:5934
                #16 0x558b07ce4119 in create_table_impl /test/11.0_opt_san/sql/sql_table.cc:4607
                #17 0x558b07ce6df0 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/11.0_opt_san/sql/sql_table.cc:4708
                #18 0x558b07d06f5f in mysql_create_table /test/11.0_opt_san/sql/sql_table.cc:4824
                #19 0x558b07d06f5f in Sql_cmd_create_table_like::execute(THD*) /test/11.0_opt_san/sql/sql_table.cc:12411
                #20 0x558b076f26dc in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:6001
                #21 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000
                #22 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894
                #23 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407
                #24 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416
                #25 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318
                #26 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442
             
            previously allocated by thread T15 here:
                #0 0x558b06e4c197 in operator new(unsigned long) (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x790b197)
                #1 0x154d77c83aa5 in __gnu_cxx::new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/include/c++/11/ext/new_allocator.h:127
                #2 0x154d77c83aa5 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:464
                #3 0x154d77c83aa5 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate(unsigned long) /usr/include/c++/11/bits/stl_vector.h:346
                #4 0x154d77c83aa5 in rocksdb::DbPath* std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > > >(unsigned long, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >) /usr/include/c++/11/bits/stl_vector.h:1511
                #5 0x154d77c83aa5 in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::operator=(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > const&) /usr/include/c++/11/bits/vector.tcc:226
                #6 0x154d77c86356 in rocksdb::BuildDBOptions(rocksdb::ImmutableDBOptions const&, rocksdb::MutableDBOptions const&) /test/11.0_opt_san/storage/rocksdb/rocksdb/options/options_helper.cc:52
                #7 0x154d76eb8b13 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779
                #8 0x154d76d397f6 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308
                #9 0x154d76d397f6 in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/11.0_opt_san/storage/rocksdb/rdb_datadic.cc:591
                #10 0x154d76a45769 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7590
                #11 0x154d76abde30 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7181
                #12 0x154d76abee74 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7767
                #13 0x154d76ac0ca9 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7914
                #14 0x558b08bc668e in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/sql/handler.cc:5465
                #15 0x558b08bcb0ef in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/11.0_opt_san/sql/handler.cc:5934
                #16 0x558b07ce4119 in create_table_impl /test/11.0_opt_san/sql/sql_table.cc:4607
                #17 0x558b07ce6df0 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/11.0_opt_san/sql/sql_table.cc:4708
                #18 0x558b07d06f5f in mysql_create_table /test/11.0_opt_san/sql/sql_table.cc:4824
                #19 0x558b07d06f5f in Sql_cmd_create_table_like::execute(THD*) /test/11.0_opt_san/sql/sql_table.cc:12411
                #20 0x558b076f26dc in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:6001
                #21 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000
                #22 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894
                #23 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407
                #24 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416
                #25 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318
                #26 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442
             
            Thread T15 created by T0 here:
                #0 0x558b06dee675 in pthread_create (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x78ad675)
                #1 0x558b06ea2d3e in create_thread_to_handle_connection(CONNECT*) /test/11.0_opt_san/sql/mysqld.cc:6100
                #2 0x558b06eb504f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_opt_san/sql/mysqld.cc:6221
                #3 0x558b06eb5fd7 in handle_connections_sockets() /test/11.0_opt_san/sql/mysqld.cc:6345
                #4 0x558b06eb903d in mysqld_main(int, char**) /test/11.0_opt_san/sql/mysqld.cc:5995
                #5 0x154d9f93fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
             
            SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/11/bits/shared_ptr_base.h:1296 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const
            Shadow bytes around the buggy address:
              0x0c087fffe9c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
              0x0c087fffe9d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffe9e0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffe9f0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffea00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
            =>0x0c087fffea10: fa fa fd fd fd fd fd fa fa fa fd[fd]fd fd fd fa
              0x0c087fffea20: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffea30: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
              0x0c087fffea40: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
              0x0c087fffea50: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd
              0x0c087fffea60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Container overflow:      fc
              Array cookie:            ac
              Intra object redzone:    bb
              ASan internal:           fe
              Left alloca redzone:     ca
              Right alloca redzone:    cb
              Shadow gap:              cc
            ==3194184==ABORTING
            

            Bug confirmed present in:
            MariaDB: 10.3.38 (dbg), 10.3.38 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.2 (dbg), 10.11.2 (opt), 11.0.1 (dbg), 11.0.1 (opt)

            UniqueID's seen for this testcase:

            SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_last_intern
            SIGSEGV|myrocks::ha_rocksdb::index_first|myrocks::ha_rocksdb::inplace_populate_sk|myrocks::ha_rocksdb::inplace_alter_table|handler::ha_inplace_alter_table
            SIGSEGV|rocksdb::DBImpl::NewIterator|rocksdb::TransactionBaseImpl::GetIterator|myrocks::Rdb_transaction::get_iterator|myrocks::ha_rocksdb::setup_scan_iterator
            ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first
            

            Roel Roel Van de Paar added a comment - - edited I also ran into this. May be lightly sporadic SET max_statement_time=0.1; INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so' ; SET SESSION default_storage_engine= 'RocksDB' ; CREATE TABLE t (c INT ,c2 CHAR (1),c3 INT (1),c4 VARCHAR (1) KEY ,c5 INT UNIQUE KEY ,c6 DECIMAL (0,0) DEFAULT 3.1); --error ER_NO_TABLES_USED SELECT *; CREATE INDEX t_c2_idx ON t (c2); Leads to: 11.0.1 f2dc4d4c10ac36a73b5c1eb765352d3aee808d66 (Debug) Core was generated by `/test/MD180223-mariadb-11.0.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000015093d75784f in myrocks::ha_rocksdb::index_first ( this=0x1508f40828f0, buf=0x1508f4279b88 <incomplete sequence \357>) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:9220 9220 ? index_last_intern(buf) [Current thread is 1 (Thread 0x15093dc1a640 (LWP 2879915))] (gdb) bt #0 0x000015093d75784f in myrocks::ha_rocksdb::index_first (this=0x1508f40828f0, buf=0x1508f4279b88 <incomplete sequence \357>) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:9220 #1 0x000015093d7660e2 in myrocks::ha_rocksdb::inplace_populate_sk (this=this@entry=0x1508f40828f0, new_table_arg=new_table_arg@entry=0x15093dc169f0, indexes=std::unordered_set with 1 element = { [0] = std::shared_ptr<myrocks::Rdb_key_def> (use count 3, weak count 0) = { get() = 0x1508f426f720 } }) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:12857 #2 0x000015093d766898 in myrocks::ha_rocksdb::inplace_alter_table (this=0x1508f40828f0, altered_table=0x15093dc169f0, ha_alter_info=0x15093dc16930) at /test/11.0_dbg/storage/rocksdb/ha_rocksdb.cc:12745 #3 0x000055efd0a55564 in handler::ha_inplace_alter_table (ha_alter_info=0x15093dc16930, altered_table=0x15093dc169f0, this=<optimized out>) at /test/11.0_dbg/sql/handler.h:4823 #4 mysql_inplace_alter_table (thd=thd@entry=0x1508f4000d58, table_list=0x1508f4013230, table=table@entry=0x1508f4007ed8, altered_table=altered_table@entry=0x15093dc169f0, ha_alter_info=ha_alter_info@entry=0x15093dc16930, target_mdl_request=target_mdl_request@entry=0x15093dc171d0, ddl_log_state=0x15093dc168c0, trigger_param=0x15093dc16db0, alter_ctx=0x15093dc180b0, partial_alter=@0x15093dc1682f: false, start_alter_id=@0x15093dc16838: 0, if_exists=false) at /test/11.0_dbg/sql/sql_table.cc:7681 #5 0x000055efd0a677fb in mysql_alter_table (thd=thd@entry=0x1508f4000d58, new_db=new_db@entry=0x1508f4013248, new_name=new_name@entry=0x1508f4013258, create_info=create_info@entry=0x15093dc18f00, table_list=<optimized out>, table_list@entry=0x1508f4013230, recreate_info=recreate_info@entry=0x15093dc18e00, alter_info=<optimized out>, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/11.0_dbg/sql/sql_table.cc:10783 #6 0x000055efd0985101 in mysql_execute_command (thd=thd@entry=0x1508f4000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/11.0_dbg/sql/sql_parse.cc:4214 #7 0x000055efd098b7cf in mysql_parse (thd=thd@entry=0x1508f4000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x15093dc192c0) at /test/11.0_dbg/sql/sql_parse.cc:8002 #8 0x000055efd098d963 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1508f4000d58, packet=packet@entry=0x1508f400ae19 "CREATE INDEX t_c2_idx ON t (c2)", packet_length=packet_length@entry=31, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_class.h:242 #9 0x000055efd098f7bc in do_command (thd=0x1508f4000d58, blocking=blocking@entry=true) at /test/11.0_dbg/sql/sql_parse.cc:1407 #10 0x000055efd0ae06e2 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55efd318d8a8, put_in_cache=put_in_cache@entry=true) at /test/11.0_dbg/sql/sql_connect.cc:1416 #11 0x000055efd0ae0941 in handle_one_connection (arg=0x55efd318d8a8) at /test/11.0_dbg/sql/sql_connect.cc:1318 #12 0x0000150956ce0b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #13 0x0000150956d72a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 10.7.8 bc656c4fa54c12ceabd857e8ae134f8979d82944 (Debug) Core was generated by `/test/MD110223-mariadb-10.7.8-linux-x86_64-dbg/bin/mariadbd --no-defaults --cor'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000014e65176ca77 in myrocks::ha_rocksdb::can_use_bloom_filter ( this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=..., eq_cond=..., use_all_keys=use_all_keys@entry=false) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13925 [Current thread is 1 (Thread 0x14e651c34640 (LWP 2879882))] (gdb) bt #0 0x000014e65176ca77 in myrocks::ha_rocksdb::can_use_bloom_filter (this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, eq_cond=@0x14e651c2fc10: {data_ = 0x14e61c22e578 "Q\272Z襥", '\245' <repeats 18 times>, size_ = 4}, use_all_keys=use_all_keys@entry=false) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13925 #1 0x000014e65176caba in myrocks::ha_rocksdb::check_bloom_and_set_bounds (this=this@entry=0x14e61c081ed0, thd=<optimized out>, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, eq_cond=@0x14e651c2fc10: {data_ = 0x14e61c22e578 "Q\272Z襥", '\245' <repeats 18 times>, size_ = 4}, use_all_keys=use_all_keys@entry=false, bound_len=bound_len@entry=4, lower_bound=0x14e61c086338 '\245' <repeats 24 times>, "\n\243\060_3Vw$%\020", upper_bound=0x14e61c24e7c8 '\245' <repeats 24 times>, "@", lower_bound_slice=0x14e61c082460, upper_bound_slice=0x14e61c082470) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:13869 #2 0x000014e651772aa4 in myrocks::ha_rocksdb::setup_scan_iterator (this=this@entry=0x14e61c081ed0, kd=@0x14e61c2d2e10: {static CF_FLAGS_TO_IGNORE = 4, m_index_number = 1371167464, m_index_number_storage_form = "\346\024\000", m_cf_handle = 0x6f777420200a6573, m_index_dict_version = 30559, m_index_type = 114 'r', m_kv_format_version = 25972, m_is_reverse_cf = 95, m_is_per_partition_cf = 113, m_name = <error: Cannot access memory at address 0x72743d7365756575>, m_stats = {m_gl_index_id = {cf_id = 1, index_id = 2037540214}, m_data_size = 131072, m_rows = 22978547774752, m_actual_disk_size = 6876556134853902341, m_entry_deletes = 0, m_entry_single_deletes = 22979446207752, m_entry_merges = 742039838958505533, m_entry_others = 0, m_distinct_keys_per_prefix = std::vector of length 0, capacity 0, m_name = ""}, m_index_flags_bitmap = 0, m_total_index_flags_length = 0, m_ttl_rec_offset = 0, m_ttl_duration = 22978547757544, m_ttl_column = "\260\061", m_pk_key_parts = 472724152, m_pk_part_no = 0x14e61c2d32b8, m_pack_info = 0x14e61c2d2ed8, m_keyno = 1918856704, m_key_parts = 1633968485, m_ttl_pk_key_part_offset = 1684104552, m_ttl_field_index = 2053731167, m_prefix_extractor = <error reading variable: Cannot access memory at address 0x6972775f656c6269>, m_maxlength = 1952408948, m_mutex = {m_mutex = {global = {__data = {__lock = 1684103012, __count = 1769238625, __owner = 1371161520, __nusers = 5350, __kind = 1, __spins = 25971, __elision = 8202, __list = {__prev = 0x80000, __next = 0x0}}, __size = "d_adapti\260C\272Q\346\024\000\000\001\000\000\000se\n \000\000\b", '\000' <repeats 12 times>, __align = 7598822034879111012}, mutex = {__data = {__lock = 472724048, __count = 5350, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x646e756f72676b63, __next = 0x746361706d6f635f}}, __size = "P2-\034\346\024", '\000' <repeats 18 times>, "ckground_compact", __align = 22978547757648}, file = 0xa312d3d736e6f69 <error: Cannot access memory at address 0xa312d3d736e6f69>, name = 0x14e61c2d2f78 "ckground_compactions=-1\nx/-\034\346\024", line = 472723320, count = 5350, create_flags = 7378714104862105965, active_flags = 4424076802287170149, id = 735836290837393457, thread = 6873734858722582560, locked_mutex = 0x14e61c2d2f78, used_mutex = 0x14e61c2da620, prev = 0x0, next = 0x0}, m_psi = 0x0}}, slice=slice@entry=0x14e651c2fcf0, use_all_keys=use_all_keys@entry=false, eq_cond_len=eq_cond_len@entry=4) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:10509 #3 0x000014e6517795fd in myrocks::ha_rocksdb::index_last_intern (this=0x14e61c081ed0, buf=0x14e61c24d3b8 <incomplete sequence \357>) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:9369 #4 0x000014e6517797ea in myrocks::ha_rocksdb::index_first (this=<optimized out>, buf=<optimized out>) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:9195 #5 0x000014e65178803a in myrocks::ha_rocksdb::inplace_populate_sk (this=this@entry=0x14e61c081ed0, new_table_arg=new_table_arg@entry=0x14e651c30a70, indexes=std::unordered_set with 1 element = { [0] = std::shared_ptr<myrocks::Rdb_key_def> (use count 3, weak count 0) = { get() = 0x14e61c26dbc0 } }) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:12832 #6 0x000014e6517887f0 in myrocks::ha_rocksdb::inplace_alter_table (this=0x14e61c081ed0, altered_table=0x14e651c30a70, ha_alter_info=0x14e651c309b0) at /test/10.7_dbg/storage/rocksdb/ha_rocksdb.cc:12720 #7 0x0000560c5c4843de in handler::ha_inplace_alter_table (ha_alter_info=0x14e651c309b0, altered_table=0x14e651c30a70, this=<optimized out>) at /test/10.7_dbg/sql/handler.h:4607 #8 mysql_inplace_alter_table (thd=thd@entry=0x14e61c000d58, table_list=0x14e61c0131c0, table=table@entry=0x14e61c272668, altered_table=altered_table@entry=0x14e651c30a70, ha_alter_info=ha_alter_info@entry=0x14e651c309b0, target_mdl_request=target_mdl_request@entry=0x14e651c31240, ddl_log_state=0x14e651c30940, trigger_param=0x14e651c30e30, alter_ctx=0x14e651c32110) at /test/10.7_dbg/sql/sql_table.cc:7522 #9 0x0000560c5c49604f in mysql_alter_table (thd=thd@entry=0x14e61c000d58, new_db=new_db@entry=0x14e61c0131d8, new_name=new_name@entry=0x14e61c0131e8, create_info=create_info@entry=0x14e651c32f50, table_list=<optimized out>, table_list@entry=0x14e61c0131c0, recreate_info=recreate_info@entry=0x14e651c32e50, alter_info=<optimized out>, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/10.7_dbg/sql/sql_table.cc:10454 #10 0x0000560c5c3bc78a in mysql_execute_command (thd=thd@entry=0x14e61c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.7_dbg/sql/sql_parse.cc:4213 #11 0x0000560c5c3c2dc2 in mysql_parse (thd=thd@entry=0x14e61c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e651c332d0) at /test/10.7_dbg/sql/sql_parse.cc:8019 #12 0x0000560c5c3c4f56 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e61c000d58, packet=packet@entry=0x14e61c00ada9 "CREATE INDEX t_c2_idx ON t (c2)", packet_length=packet_length@entry=31, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_class.h:240 #13 0x0000560c5c3c6daf in do_command (thd=0x14e61c000d58, blocking=blocking@entry=true) at /test/10.7_dbg/sql/sql_parse.cc:1407 #14 0x0000560c5c50cfea in do_handle_one_connection (connect=<optimized out>, connect@entry=0x560c5f835858, put_in_cache=put_in_cache@entry=true) at /test/10.7_dbg/sql/sql_connect.cc:1416 #15 0x0000560c5c50d249 in handle_one_connection (arg=0x560c5f835858) at /test/10.7_dbg/sql/sql_connect.cc:1318 #16 0x000014e66a736b43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #17 0x000014e66a7c8a00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 10.5.20 c41c79650aa2ef8eaf3f887b94db8cc7478eadd1 (Optimized) Core was generated by `/test/MD110223-mariadb-10.5.20-linux-x86_64-opt/bin/mariadbd --no-defaults --co'. Program terminated with signal SIGSEGV, Segmentation fault. #0 rocksdb::DBImpl::NewIterator (this=0x148828209460, read_options=..., column_family=0x1000001488282601) at /test/10.5_opt/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2482 [Current thread is 1 (Thread 0x1488940d7640 (LWP 2879868))] (gdb) bt #0 rocksdb::DBImpl::NewIterator (this=0x148828209460, read_options=@0x1488940d3110: {snapshot = 0x1488282c2150, iterate_lower_bound = 0x1488282caf20, iterate_upper_bound = 0x1488282caf30, readahead_size = 0, max_skippable_internal_keys = 0, read_tier = rocksdb::kReadAllTier, verify_checksums = true, fill_cache = true, tailing = false, managed = false, total_order_seek = true, auto_prefix_mode = false, prefix_same_as_start = false, pin_data = false, background_purge_on_iterator_cleanup = false, ignore_range_deletions = false, table_filter = {<std::_Maybe_unary_or_binary_function<bool, rocksdb::TableProperties const&>> = {<std::unary_function<rocksdb::TableProperties const&, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x0, _M_const_object = 0x0, _M_function_pointer = 0x0, _M_member_pointer = NULL}, _M_pod_data = '\000' <repeats 15 times>}, _M_manager = 0x0}, _M_invoker = 0x0}, iter_start_seqnum = 0, timestamp = 0x0}, column_family=0x1000001488282601) at /test/10.5_opt/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2482 #1 0x0000148884cb6568 in rocksdb::TransactionBaseImpl::GetIterator (this=0x148828237a70, read_options=@0x1488940d3110: {snapshot = 0x1488282c2150, iterate_lower_bound = 0x1488282caf20, iterate_upper_bound = 0x1488282caf30, readahead_size = 0, max_skippable_internal_keys = 0, read_tier = rocksdb::kReadAllTier, verify_checksums = true, fill_cache = true, tailing = false, managed = false, total_order_seek = true, auto_prefix_mode = false, prefix_same_as_start = false, pin_data = false, background_purge_on_iterator_cleanup = false, ignore_range_deletions = false, table_filter = {<std::_Maybe_unary_or_binary_function<bool, rocksdb::TableProperties const&>> = {<std::unary_function<rocksdb::TableProperties const&, bool>> = {<No data fields>}, <No data fields>}, <std::_Function_base> = {static _M_max_size = 16, static _M_max_align = 8, _M_functor = {_M_unused = {_M_object = 0x0, _M_const_object = 0x0, _M_function_pointer = 0x0, _M_member_pointer = NULL}, _M_pod_data = '\000' <repeats 15 times>}, _M_manager = 0x0}, _M_invoker = 0x0}, iter_start_seqnum = 0, timestamp = 0x0}, column_family=0x1000001488282601) at /test/10.5_opt/storage/rocksdb/rocksdb/utilities/transactions/transaction_base.cc:369 #2 0x000014888491f1cd in myrocks::Rdb_transaction::get_iterator (create_snapshot=true, read_current=false, eq_cond_upper_bound=@0x1488282caf30: {data_ = 0x148828262bc8 "\210(&\a\210\024", size_ = 4}, eq_cond_lower_bound=@0x1488282caf20: {data_ = 0x148828007728 "\210(&\006eforePrepareWrite", size_ = 4}, fill_cache=true, skip_bloom_filter=true, column_family=0x1000001488282601, this=0x14882823c730) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:3011 #3 myrocks::ha_rocksdb::setup_scan_iterator (this=0x1488282ca990, kd=<optimized out>, slice=<optimized out>, use_all_keys=<optimized out>, eq_cond_len=<optimized out>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:10551 #4 0x00001488849200fe in myrocks::ha_rocksdb::index_first_intern (this=this@entry=0x1488282ca990, buf=0x14882825ebf8 <incomplete sequence \357>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:9274 #5 0x00001488849314be in myrocks::ha_rocksdb::index_first (buf=<optimized out>, this=0x1488282ca990) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:9193 #6 myrocks::ha_rocksdb::inplace_populate_sk (this=0x1488282ca990, new_table_arg=0x1488940d36c0, indexes=<optimized out>) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:12824 #7 0x0000148884931aef in myrocks::ha_rocksdb::inplace_alter_table (this=0x1488282ca990, altered_table=0x1488940d36c0, ha_alter_info=0x1488940d3620) at /test/10.5_opt/storage/rocksdb/ha_rocksdb.cc:12712 #8 0x00005608a66698f5 in handler::ha_inplace_alter_table (ha_alter_info=0x1488940d3620, altered_table=0x1488940d36c0, this=<optimized out>) at /test/10.5_opt/sql/handler.h:4520 #9 mysql_inplace_alter_table (target_mdl_request=0x1488940d3ac0, alter_ctx=0x1488940d4e20, ha_alter_info=0x1488940d3620, altered_table=0x1488940d36c0, table=0x148828211408, table_list=0x148828010540, thd=0x148828000c68) at /test/10.5_opt/sql/sql_table.cc:8159 #10 mysql_alter_table (thd=thd@entry=0x148828000c68, new_db=new_db@entry=0x148828010558, new_name=new_name@entry=0x148828010568, create_info=create_info@entry=0x1488940d5ab0, table_list=<optimized out>, table_list@entry=0x148828010540, recreate_info=recreate_info@entry=0x1488940d59b0, alter_info=0x1488940d59e0, order_num=0, order=0x0, ignore=false, if_exists=false) at /test/10.5_opt/sql/sql_table.cc:10879 #11 0x00005608a65c0478 in mysql_execute_command (thd=0x148828000c68) at /test/10.5_opt/sql/sql_parse.cc:4274 #12 0x00005608a65c4522 in mysql_parse (thd=0x148828000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:8091 #13 0x00005608a65c69ca in dispatch_command (command=COM_QUERY, thd=0x148828000c68, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.5_opt/sql/sql_parse.cc:1990 #14 0x00005608a65c8be0 in do_command (thd=0x148828000c68) at /test/10.5_opt/sql/sql_parse.cc:1375 #15 0x00005608a66c27d6 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5608a86a2538, put_in_cache=put_in_cache@entry=true) at /test/10.5_opt/sql/sql_connect.cc:1416 #16 0x00005608a66c2a7d in handle_one_connection (arg=0x5608a86a2538) at /test/10.5_opt/sql/sql_connect.cc:1318 #17 0x000014889ebbdb43 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442 #18 0x000014889ec4fa00 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81 11.0.1 4d09050ca77a7efac4565d46e4bcd85a5f210c53 (Optimized, UBASAN) ================================================================= ==3194184==ERROR: AddressSanitizer: heap-use-after-free on address 0x6040000350d8 at pc 0x154d76a7c34e bp 0x154d7d6b56d0 sp 0x154d7d6b56c0 READ of size 8 at 0x6040000350d8 thread T15 #0 0x154d76a7c34d in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const /usr/include/c++/11/bits/shared_ptr_base.h:1296 #1 0x154d76a7c34d in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::_M_get() const /usr/include/c++/11/bits/shared_ptr_base.h:993 #2 0x154d76a7c34d in std::__shared_ptr_access<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2, false, false>::operator->() const /usr/include/c++/11/bits/shared_ptr_base.h:987 #3 0x154d76a7c34d in myrocks::ha_rocksdb::index_first(unsigned char*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:9200 #4 0x154d76aee4ce in myrocks::ha_rocksdb::inplace_populate_sk(TABLE*, std::unordered_set<std::shared_ptr<myrocks::Rdb_key_def>, std::hash<std::shared_ptr<myrocks::Rdb_key_def> >, std::equal_to<std::shared_ptr<myrocks::Rdb_key_def> >, std::allocator<std::shared_ptr<myrocks::Rdb_key_def> > > const&) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:12838 #5 0x154d76af1da1 in myrocks::ha_rocksdb::inplace_alter_table(TABLE*, Alter_inplace_info*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:12726 #6 0x558b07d2bb3d in handler::ha_inplace_alter_table(TABLE*, Alter_inplace_info*) /test/11.0_opt_san/sql/handler.h:4588 #7 0x558b07d2bb3d in mysql_inplace_alter_table /test/11.0_opt_san/sql/sql_table.cc:7680 #8 0x558b07d2bb3d in mysql_alter_table(THD*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, TABLE_LIST*, Alter_info*, unsigned int, st_order*, bool, bool) /test/11.0_opt_san/sql/sql_table.cc:10781 #9 0x558b076f87cb in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:4213 #10 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000 #11 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894 #12 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407 #13 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416 #14 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318 #15 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442 #16 0x154d9fa3c9ff (/lib/x86_64-linux-gnu/libc.so.6+0x1269ff)   0x6040000350d8 is located 8 bytes inside of 40-byte region [0x6040000350d0,0x6040000350f8) freed by thread T15 here: #0 0x558b06e4ccb7 in operator delete(void*) (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x790bcb7) #1 0x154d76b760bd in __gnu_cxx::new_allocator<rocksdb::DbPath>::deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/11/ext/new_allocator.h:145 #2 0x154d76b760bd in std::allocator_traits<std::allocator<rocksdb::DbPath> >::deallocate(std::allocator<rocksdb::DbPath>&, rocksdb::DbPath*, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:496 #3 0x154d76b760bd in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_deallocate(rocksdb::DbPath*, unsigned long) /usr/include/c++/11/bits/stl_vector.h:354 #4 0x154d76b760bd in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~_Vector_base() /usr/include/c++/11/bits/stl_vector.h:335 #5 0x154d76b760bd in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::~vector() /usr/include/c++/11/bits/stl_vector.h:683 #6 0x154d76b760bd in rocksdb::DBOptions::~DBOptions() /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/options.h:350 #7 0x154d76eba2f6 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779 #8 0x154d76d397f6 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308 #9 0x154d76d397f6 in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/11.0_opt_san/storage/rocksdb/rdb_datadic.cc:591 #10 0x154d76a45769 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7590 #11 0x154d76abde30 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7181 #12 0x154d76abee74 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7767 #13 0x154d76ac0ca9 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7914 #14 0x558b08bc668e in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/sql/handler.cc:5465 #15 0x558b08bcb0ef in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/11.0_opt_san/sql/handler.cc:5934 #16 0x558b07ce4119 in create_table_impl /test/11.0_opt_san/sql/sql_table.cc:4607 #17 0x558b07ce6df0 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/11.0_opt_san/sql/sql_table.cc:4708 #18 0x558b07d06f5f in mysql_create_table /test/11.0_opt_san/sql/sql_table.cc:4824 #19 0x558b07d06f5f in Sql_cmd_create_table_like::execute(THD*) /test/11.0_opt_san/sql/sql_table.cc:12411 #20 0x558b076f26dc in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:6001 #21 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000 #22 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894 #23 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407 #24 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416 #25 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318 #26 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442   previously allocated by thread T15 here: #0 0x558b06e4c197 in operator new(unsigned long) (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x790b197) #1 0x154d77c83aa5 in __gnu_cxx::new_allocator<rocksdb::DbPath>::allocate(unsigned long, void const*) /usr/include/c++/11/ext/new_allocator.h:127 #2 0x154d77c83aa5 in std::allocator_traits<std::allocator<rocksdb::DbPath> >::allocate(std::allocator<rocksdb::DbPath>&, unsigned long) /usr/include/c++/11/bits/alloc_traits.h:464 #3 0x154d77c83aa5 in std::_Vector_base<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate(unsigned long) /usr/include/c++/11/bits/stl_vector.h:346 #4 0x154d77c83aa5 in rocksdb::DbPath* std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::_M_allocate_and_copy<__gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > > >(unsigned long, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >, __gnu_cxx::__normal_iterator<rocksdb::DbPath const*, std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > >) /usr/include/c++/11/bits/stl_vector.h:1511 #5 0x154d77c83aa5 in std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> >::operator=(std::vector<rocksdb::DbPath, std::allocator<rocksdb::DbPath> > const&) /usr/include/c++/11/bits/vector.tcc:226 #6 0x154d77c86356 in rocksdb::BuildDBOptions(rocksdb::ImmutableDBOptions const&, rocksdb::MutableDBOptions const&) /test/11.0_opt_san/storage/rocksdb/rocksdb/options/options_helper.cc:52 #7 0x154d76eb8b13 in rocksdb::DBImpl::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/db/db_impl/db_impl.cc:2779 #8 0x154d76d397f6 in rocksdb::StackableDB::GetOptions(rocksdb::ColumnFamilyHandle*) const /test/11.0_opt_san/storage/rocksdb/rocksdb/include/rocksdb/utilities/stackable_db.h:308 #9 0x154d76d397f6 in myrocks::Rdb_key_def::setup(TABLE const*, myrocks::Rdb_tbl_def const*) /test/11.0_opt_san/storage/rocksdb/rdb_datadic.cc:591 #10 0x154d76a45769 in myrocks::ha_rocksdb::create_key_def(TABLE const*, unsigned int, myrocks::Rdb_tbl_def const*, std::shared_ptr<myrocks::Rdb_key_def>*, myrocks::ha_rocksdb::key_def_cf_info const&, unsigned long long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7590 #11 0x154d76abde30 in myrocks::ha_rocksdb::create_key_defs(TABLE const*, myrocks::Rdb_tbl_def*, TABLE const*, myrocks::Rdb_tbl_def const*) const /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7181 #12 0x154d76abee74 in myrocks::ha_rocksdb::create_table(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, TABLE const*, unsigned long long) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7767 #13 0x154d76ac0ca9 in myrocks::ha_rocksdb::create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/storage/rocksdb/ha_rocksdb.cc:7914 #14 0x558b08bc668e in handler::ha_create(char const*, TABLE*, HA_CREATE_INFO*) /test/11.0_opt_san/sql/handler.cc:5465 #15 0x558b08bcb0ef in ha_create_table(THD*, char const*, char const*, char const*, HA_CREATE_INFO*, st_mysql_const_unsigned_lex_string*, bool) /test/11.0_opt_san/sql/handler.cc:5934 #16 0x558b07ce4119 in create_table_impl /test/11.0_opt_san/sql/sql_table.cc:4607 #17 0x558b07ce6df0 in mysql_create_table_no_lock(THD*, st_ddl_log_state*, st_ddl_log_state*, st_mysql_const_lex_string const*, st_mysql_const_lex_string const*, Table_specification_st*, Alter_info*, bool*, int, TABLE_LIST*) /test/11.0_opt_san/sql/sql_table.cc:4708 #18 0x558b07d06f5f in mysql_create_table /test/11.0_opt_san/sql/sql_table.cc:4824 #19 0x558b07d06f5f in Sql_cmd_create_table_like::execute(THD*) /test/11.0_opt_san/sql/sql_table.cc:12411 #20 0x558b076f26dc in mysql_execute_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:6001 #21 0x558b07716542 in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.0_opt_san/sql/sql_parse.cc:8000 #22 0x558b07723fa5 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.0_opt_san/sql/sql_parse.cc:1894 #23 0x558b0772d700 in do_command(THD*, bool) /test/11.0_opt_san/sql/sql_parse.cc:1407 #24 0x558b0800e03c in do_handle_one_connection(CONNECT*, bool) /test/11.0_opt_san/sql/sql_connect.cc:1416 #25 0x558b0801063c in handle_one_connection /test/11.0_opt_san/sql/sql_connect.cc:1318 #26 0x154d9f9aab42 in start_thread nptl/pthread_create.c:442   Thread T15 created by T0 here: #0 0x558b06dee675 in pthread_create (/test/UBASAN_MD130223-mariadb-11.0.1-linux-x86_64-opt/bin/mariadbd+0x78ad675) #1 0x558b06ea2d3e in create_thread_to_handle_connection(CONNECT*) /test/11.0_opt_san/sql/mysqld.cc:6100 #2 0x558b06eb504f in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /test/11.0_opt_san/sql/mysqld.cc:6221 #3 0x558b06eb5fd7 in handle_connections_sockets() /test/11.0_opt_san/sql/mysqld.cc:6345 #4 0x558b06eb903d in mysqld_main(int, char**) /test/11.0_opt_san/sql/mysqld.cc:5995 #5 0x154d9f93fd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58   SUMMARY: AddressSanitizer: heap-use-after-free /usr/include/c++/11/bits/shared_ptr_base.h:1296 in std::__shared_ptr<myrocks::Rdb_key_def, (__gnu_cxx::_Lock_policy)2>::get() const Shadow bytes around the buggy address: 0x0c087fffe9c0: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x0c087fffe9d0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffe9e0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffe9f0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffea00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa =>0x0c087fffea10: fa fa fd fd fd fd fd fa fa fa fd[fd]fd fd fd fa 0x0c087fffea20: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffea30: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c087fffea40: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd 0x0c087fffea50: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x0c087fffea60: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3194184==ABORTING Bug confirmed present in: MariaDB: 10.3.38 (dbg), 10.3.38 (opt), 10.4.29 (dbg), 10.4.29 (opt), 10.5.20 (dbg), 10.5.20 (opt), 10.6.13 (dbg), 10.6.13 (opt), 10.7.8 (dbg), 10.7.8 (opt), 10.8.8 (dbg), 10.8.8 (opt), 10.9.6 (dbg), 10.9.6 (opt), 10.10.4 (dbg), 10.10.4 (opt), 10.11.2 (dbg), 10.11.2 (opt), 11.0.1 (dbg), 11.0.1 (opt) UniqueID's seen for this testcase: SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_last_intern SIGSEGV|myrocks::ha_rocksdb::index_first|myrocks::ha_rocksdb::inplace_populate_sk|myrocks::ha_rocksdb::inplace_alter_table|handler::ha_inplace_alter_table SIGSEGV|rocksdb::DBImpl::NewIterator|rocksdb::TransactionBaseImpl::GetIterator|myrocks::Rdb_transaction::get_iterator|myrocks::ha_rocksdb::setup_scan_iterator ASAN|heap-use-after-free|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first
            Roel Roel Van de Paar added a comment - - edited

            The crash can also be seen in other areas, and it looks like there is some partial stack smashing happening (towards the middle/end of the stack), likely due to the heap-use-after-free. For example (still for the same testcase);

            SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_first_intern
            SIGSEGV|rocksdb::DBImpl::NewIterator|rocksdb::TransactionBaseImpl::GetIterator|myrocks::Rdb_transaction_impl::get_iterator|myrocks::Rdb_transaction::get_iterator
            

            Roel Roel Van de Paar added a comment - - edited The crash can also be seen in other areas, and it looks like there is some partial stack smashing happening (towards the middle/end of the stack), likely due to the heap-use-after-free. For example (still for the same testcase); SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_first_intern SIGSEGV|rocksdb::DBImpl::NewIterator|rocksdb::TransactionBaseImpl::GetIterator|myrocks::Rdb_transaction_impl::get_iterator|myrocks::Rdb_transaction::get_iterator

            SET sql_mode='';
            SET SESSION optimizer_switch='semijoin=ON';
            INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so';
            SET max_statement_time=0.1;
            SET SESSION enforce_storage_engine=RocksDB;
            CREATE TABLE t (c DOUBLE KEY,c2 CHAR,c3 CHAR,c4 DATE,c5 TEXT) ROW_FORMAT=REDUNDANT;
            ALTER TABLE t ENGINE MEMORY;
            ALTER TABLE t ADD INDEX (c3);
            

            Different runs on same instance can & do give different stacks. Subset:

            SIGSEGV|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_last_intern|myrocks::ha_rocksdb::index_first
            SIGSEGV|myrocks::ha_rocksdb::index_first|myrocks::ha_rocksdb::inplace_populate_sk|myrocks::ha_rocksdb::inplace_alter_table|handler::ha_inplace_alter_table
            SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator
            

            Roel Roel Van de Paar added a comment - SET sql_mode= '' ; SET SESSION optimizer_switch= 'semijoin=ON' ; INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so' ; SET max_statement_time=0.1; SET SESSION enforce_storage_engine=RocksDB; CREATE TABLE t (c DOUBLE KEY ,c2 CHAR ,c3 CHAR ,c4 DATE ,c5 TEXT) ROW_FORMAT=REDUNDANT; ALTER TABLE t ENGINE MEMORY; ALTER TABLE t ADD INDEX (c3); Different runs on same instance can & do give different stacks. Subset: SIGSEGV|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator|myrocks::ha_rocksdb::index_last_intern|myrocks::ha_rocksdb::index_first SIGSEGV|myrocks::ha_rocksdb::index_first|myrocks::ha_rocksdb::inplace_populate_sk|myrocks::ha_rocksdb::inplace_alter_table|handler::ha_inplace_alter_table SIGSEGV|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::can_use_bloom_filter|myrocks::ha_rocksdb::check_bloom_and_set_bounds|myrocks::ha_rocksdb::setup_scan_iterator
            Roel Roel Van de Paar added a comment - - edited

            SET max_statement_time=0.1;
            INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so';
            CREATE TABLE t (a INT) ENGINE=RocksDB;
            CREATE INDEX i ON t (a);
            

            10.5.26 736449d30ffb2ec71bd700ac84eb38ba30bb662c (Optimized, UBASAN)

            ASAN|heap-buffer-overflow|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first
            

            Roel Roel Van de Paar added a comment - - edited SET max_statement_time=0.1; INSTALL PLUGIN RocksDB SONAME 'ha_rocksdb.so' ; CREATE TABLE t (a INT ) ENGINE=RocksDB; CREATE INDEX i ON t (a); 10.5.26 736449d30ffb2ec71bd700ac84eb38ba30bb662c (Optimized, UBASAN) ASAN|heap-buffer-overflow|include/c++/current_version/bits/shared_ptr_base.h|std::__shared_ptr<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|std::__shared_ptr_access<myrocks::Rdb_key_def,|myrocks::ha_rocksdb::index_first

            People

              psergei Sergei Petrunia
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.