Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-24720

Assertion `0' failed in btr_search_hash_table_validate

Details

    Description

      origin/10.6, 10.6 68b2819342a00bf18ee98f1e8d5db4b6db78b146 2021-01-27T18:41:58+02:00
       
      2021-01-28  5:09:50 33 [ERROR] InnoDB: Error in an adaptive hash index pointer to page [page id: space=5, page number=3], ptr mem address 0x56723beed201, index id 23, node fold 1270551399198, rec fold 1270308129438
      InnoDB: Record [rr 1097029 2023276]PHYSICAL RECORD: n_fields 1; compact format; info bits 0
      [rr 1097029 2023278] 0:[rr 1097029 2023280] len 4; hex [rr 1097029 2023282]00[rr 1097029 2023284]00[rr 1097029 2023286]00[rr 1097029 2023288]00[rr 1097029 2023290]; asc [rr 1097029 2023292] [rr 1097029 2023294] [rr 1097029 2023296] [rr 1097029 2023298] [rr 1097029 2023300];[rr 1097029 2023302];[rr 1097029 2023304]
      [rr 1097029 2023306]
      InnoDB: on that page. Page mem address 0x56723bee8000, is hashed 0x61600079f620, n fields 0
      InnoDB: side 0
      [rr 1097029 2023308]mysqld: /Server/10.6B/storage/innobase/btr/btr0sea.cc:2226: ulint btr_search_hash_table_validate(ulint): Assertion `0' failed.
       
      Query (0x62b0001d5238): ALTER TABLE r CHECK PARTITION p2,p3
      Status: KILL_TIMEOUT
       
      (rr) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x00004c8c136cb859 in __GI_abort () at abort.c:79
      #2  0x00004c8c136cb729 in __assert_fail_base (fmt=0x4c8c13861588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55ce9389a160 "0", file=0x55ce9389a360 "/Server/10.6B/storage/innobase/btr/btr0sea.cc", line=2226, function=<optimized out>)
          at assert.c:92
      #3  0x00004c8c136dcf36 in __GI___assert_fail (assertion=0x55ce9389a160 "0", file=0x55ce9389a360 "/Server/10.6B/storage/innobase/btr/btr0sea.cc", line=2226, function=0x55ce9389c980 "ulint btr_search_hash_table_validate(ulint)") at assert.c:101
      #4  0x000055ce922776ac in btr_search_hash_table_validate (hash_table_id=5) at /Server/10.6B/storage/innobase/btr/btr0sea.cc:2226
      #5  0x000055ce92277b28 in btr_search_validate () at /Server/10.6B/storage/innobase/btr/btr0sea.cc:2285
      #6  0x000055ce91ce304c in ha_innobase::check (this=0x61d0001568b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670) at /Server/10.6B/storage/innobase/handler/ha_innodb.cc:14654
      #7  0x000055ce911a8f91 in handler::ha_check (this=0x61d0001568b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670) at /Server/10.6B/sql/handler.cc:4586
      #8  0x000055ce91a59271 in ha_partition::handle_opt_part (this=0x61d0001536b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670, part_id=2, flag=3) at /Server/10.6B/sql/ha_partition.cc:1320
      #9  0x000055ce91a5a410 in ha_partition::handle_opt_partitions (this=0x61d0001536b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670, flag=3) at /Server/10.6B/sql/ha_partition.cc:1496
      #10 0x000055ce91a58a30 in ha_partition::check (this=0x61d0001536b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670) at /Server/10.6B/sql/ha_partition.cc:1228
      #11 0x000055ce911a8f91 in handler::ha_check (this=0x61d0001536b8, thd=0x62b0001ce218, check_opt=0x62b0001d3670) at /Server/10.6B/sql/handler.cc:4586
      #12 0x000055ce90df2184 in mysql_admin_table (thd=0x62b0001ce218, tables=0x62b0001d5398, check_opt=0x62b0001d3670, operator_name=0x55ce92d834e0 "check", lock_type=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=false, 
          extra_open_options=32, prepare_func=0x0, operator_func=(int (handler::*)(class handler * const, class THD *, HA_CHECK_OPT *)) 0x55ce911a8b08 <handler::ha_check(THD*, st_ha_check_opt*)>, view_operator_func=
          0x55ce90caebac <view_check(THD*, TABLE_LIST*, st_ha_check_opt*)>) at /Server/10.6B/sql/sql_admin.cc:853
      #13 0x000055ce90df6df4 in Sql_cmd_check_table::execute (this=0x62b0001d5ad0, thd=0x62b0001ce218) at /Server/10.6B/sql/sql_admin.cc:1423
      #14 0x000055ce90dc042e in Sql_cmd_alter_table_check_partition::execute (this=0x62b0001d5ad0, thd=0x62b0001ce218) at /Server/10.6B/sql/sql_partition_admin.cc:741
      #15 0x000055ce9099569f in mysql_execute_command (thd=0x62b0001ce218) at /Server/10.6B/sql/sql_parse.cc:5880
      #16 0x000055ce909a309f in mysql_parse (thd=0x62b0001ce218, rawbuf=0x62b0001d5238 "ALTER TABLE r CHECK PARTITION p2,p3 /* E_R Thread18 QNO 27 CON_ID 33 */", length=71, parser_state=0x4eef806a97c0) at /Server/10.6B/sql/sql_parse.cc:7906
      #17 0x000055ce90979c99 in dispatch_command (command=COM_QUERY, thd=0x62b0001ce218, packet=0x62d0000fa419 "", packet_length=72) at /Server/10.6B/sql/sql_parse.cc:1833
      #18 0x000055ce90976b5f in do_command (thd=0x62b0001ce218) at /Server/10.6B/sql/sql_parse.cc:1365
      #19 0x000055ce90db8665 in do_handle_one_connection (connect=0x608000003838, put_in_cache=true) at /Server/10.6B/sql/sql_connect.cc:1410
      #20 0x000055ce90db7fce in handle_one_connection (arg=0x608000003838) at /Server/10.6B/sql/sql_connect.cc:1312
      #21 0x000055ce91abb913 in pfs_spawn_thread (arg=0x61500000dc98) at /Server/10.6B/storage/perfschema/pfs.cc:2201
      #22 0x00007ff26b550609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #23 0x00004c8c137c8293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      (rr) quit
       
      sdp:/home/mleich/RQG_O/storage/1611834303/AHI/dev/shm/vardir/1611834303/22/1/rr
      _RR_TRACE_DIR="." rr replay --mark-stdio
       
      RQG
      ====
      git clone https://github.com/mleich1/rqg --branch experimental RQG
       
      perl rqg.pl \
      --views \
      --grammar=conf/mariadb/partitions_innodb.yy \
      --redefine=conf/mariadb/alter_table.yy \
      --redefine=conf/mariadb/instant_add.yy \
      --redefine=conf/mariadb/modules/alter_table_columns.yy \
      --redefine=conf/mariadb/sp.yy \
      --redefine=conf/mariadb/bulk_insert.yy \
      --redefine=conf/mariadb/modules/userstat.yy \
      --redefine=conf/mariadb/modules/foreign_keys.yy \
      --redefine=conf/mariadb/modules/locks.yy \
      --redefine=conf/mariadb/modules/sql_mode.yy \
      --redefine=conf/mariadb/versioning.yy \
      --redefine=conf/mariadb/sequences.yy \
      --redefine=conf/mariadb/modules/locks-10.4-extra.yy \
      --mysqld=--innodb_use_native_aio=1 \
      --mysqld=--innodb_lock_schedule_algorithm=fcfs \
      --mysqld=--loose-idle_write_transaction_timeout=0 \
      --mysqld=--loose-idle_transaction_timeout=0 \
      --mysqld=--loose-idle_readonly_transaction_timeout=0 \
      --mysqld=--connect_timeout=60 \
      --mysqld=--interactive_timeout=28800 \
      --mysqld=--slave_net_timeout=60 \
      --mysqld=--net_read_timeout=30 \
      --mysqld=--net_write_timeout=60 \
      --mysqld=--loose-table_lock_wait_timeout=50 \
      --mysqld=--wait_timeout=28800 \
      --mysqld=--lock-wait-timeout=86400 \
      --mysqld=--innodb-lock-wait-timeout=50 \
      --no-mask \
      --queries=10000000 \
      --seed=random \
      --reporters=Backtrace \
      --reporters=ErrorLog \
      --reporters=Deadlock1 \
      --validators=None \
      --mysqld=--log_output=none \
      --mysqld=--log-bin \
      --mysqld=--log_bin_trust_function_creators=1 \
      --mysqld=--loose-debug_assert_on_not_freed_memory=0 \
      --engine=InnoDB \
      --restart_timeout=240 \
      --mysqld=--plugin-load-add=file_key_management.so \
      --mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
      --duration=300 \
      --mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
      --mysqld=--innodb_stats_persistent=on \
      --mysqld=--innodb_adaptive_hash_index=on \
      --mysqld=--loose-max-statement-time=30 \
      --threads=33 \
      --mysqld=--innodb_page_size=32K \
      --mysqld=--innodb-buffer-pool-size=256M \
      --duration=300 \
      --no_mask \
      --workdir=<local settings> \
      --vardir=<local settings> \
      --mtr-build-thread=<local settings> \
      --basedir1=<local settings> \
      --script_debug=_nix_ \
      --rr=Extended \
      --rr_options=--chaos
      
      

      Attachments

        Issue Links

          Activity

            marko Marko Mäkelä added a comment - - edited

            mleich, can you repeat this before MDEV-515?

            marko Marko Mäkelä added a comment - - edited mleich , can you repeat this before MDEV-515 ?

            The test simplifier is running on a
            commit 7aed5eb76ffdec91637cb7a48bff89e4b4315f82 (origin/10.6)
            and making progress.

            mleich Matthias Leich added a comment - The test simplifier is running on a commit 7aed5eb76ffdec91637cb7a48bff89e4b4315f82 (origin/10.6) and making progress.

            Thank you, so you can repeat this with the parent commit of MDEV-515. This means that older versions than 10.6 may be affected.

            I believe that with MDEV-515, it is much easier to hit this problem, because we probably forgot to drop the adaptive hash index on dict_index_t::clear() there. The adaptive hash index must never contain entries that do not exist in the underlying index tree.

            MDEV-22456 introduced the exception that entries may point to freed pages that belonged to dropped indexes (dict_table_t::freed_indexes). Those dangling adaptive hash index entries as well as dict_table_t::freed_indexes would be removed when the garbage pages are evicted from the buffer pool, before they will be reused for something else.

            marko Marko Mäkelä added a comment - Thank you, so you can repeat this with the parent commit of MDEV-515 . This means that older versions than 10.6 may be affected. I believe that with MDEV-515 , it is much easier to hit this problem, because we probably forgot to drop the adaptive hash index on dict_index_t::clear() there. The adaptive hash index must never contain entries that do not exist in the underlying index tree. MDEV-22456 introduced the exception that entries may point to freed pages that belonged to dropped indexes ( dict_table_t::freed_indexes ). Those dangling adaptive hash index entries as well as dict_table_t::freed_indexes would be removed when the garbage pages are evicted from the buffer pool, before they will be reused for something else.

            In http://buildbot.askmonty.org/buildbot/builders/kvm-asan/builds/5154/steps/mtr_nm/logs/stdio there is something that could be related to this:

            10.4 c2c23e598d49fc991b34853d864c77d02741b61c

            CURRENT_TEST: main.innodb_mrr_cpk
            mysqltest: At line 70: query 'select * from t1, t2 where t1.a=t2.a and t1.b=t2.b' failed: 2013: Lost connection to MySQL server during query
            …
            ==177481==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb5a0 at pc 0x55e179a52888 bp 0x7f62540ba920 sp 0x7f62540ba910
            READ of size 8 at 0x6170000bb5a0 thread T19
                #0 0x55e179a52887 in btr_search_lazy_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:309
                #1 0x55e179a52a33 in btr_search_drop_page_hash_index(buf_block_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1237
                #2 0x55e17b1294fb in buf_LRU_free_page(buf_page_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:1608
                #3 0x55e17b12d1ea in buf_LRU_free_from_common_LRU_list /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:695
                #4 0x55e17b12d1ea in buf_LRU_scan_and_free_block(buf_pool_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:737
                #5 0x55e17b12e0ef in buf_LRU_get_free_block(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:966
                #6 0x55e17b0bd701 in buf_block_alloc(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0buf.cc:754
                #7 0x55e17b093d96 in btr_search_check_free_space_in_heap /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:198
                #8 0x55e17b0a0f28 in btr_search_info_update_slow(btr_search_t*, btr_cur_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1531
                #9 0x55e17b078f14 in btr_search_info_update /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0sea.ic:84
                #10 0x55e17b078f14 in btr_cur_search_to_nth_level_func(dict_index_t*, unsigned long, dtuple_t const*, page_cur_mode_t, unsigned long, btr_cur_t*, rw_lock_t*, char const*, unsigned int, mtr_t*, unsigned long) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0cur.cc:2483
                #11 0x55e17aeb4dab in btr_pcur_open_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0pcur.ic:441
                #12 0x55e17aeb528d in row_search_on_row_ref(btr_pcur_t*, unsigned long, dict_table_t const*, dtuple_t const*, mtr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0row.cc:1214
                #13 0x55e17ae9c9e3 in row_purge_reposition_pcur /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:78
                #14 0x55e17ae9cd3c in row_purge_reset_trx_id /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:798
                #15 0x55e17aea79dc in row_purge_record_func /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1212
                #16 0x55e17aeaa397 in row_purge /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1261
                #17 0x55e17aeaa397 in row_purge_step(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1320
                #18 0x55e17add6e27 in que_thr_step /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1038
                #19 0x55e17add6e27 in que_run_threads_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1100
                #20 0x55e17add6e27 in que_run_threads(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1140
                #21 0x55e17af22c01 in srv_task_execute /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2471
                #22 0x55e17af22c01 in srv_worker_thread /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2519
                #23 0x7f62669ea608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
                #24 0x7f626652c102 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122102)
             
            0x6170000bb5a0 is located 288 bytes inside of 744-byte region [0x6170000bb480,0x6170000bb768)
            freed by thread T18 here:
                #0 0x7f6266b727cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
                #1 0x55e17ad4a816 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/mem/mem0mem.cc:416
                #2 0x55e17b1ca232 in mem_heap_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/mem0mem.ic:417
                #3 0x55e17b1ca232 in dict_mem_table_free(dict_table_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/dict/dict0mem.cc:248
                #4 0x55e179a528c2 in btr_search_lazy_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:313
                #5 0x55e179a52a33 in btr_search_drop_page_hash_index(buf_block_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1237
                #6 0x55e17b1294fb in buf_LRU_free_page(buf_page_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:1608
                #7 0x55e17b12d1ea in buf_LRU_free_from_common_LRU_list /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:695
                #8 0x55e17b12d1ea in buf_LRU_scan_and_free_block(buf_pool_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:737
                #9 0x55e17b12e0ef in buf_LRU_get_free_block(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:966
                #10 0x55e17b0bd701 in buf_block_alloc(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0buf.cc:754
                #11 0x55e17b093d96 in btr_search_check_free_space_in_heap /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:198
                #12 0x55e17b0a0f28 in btr_search_info_update_slow(btr_search_t*, btr_cur_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1531
                #13 0x55e17b078f14 in btr_search_info_update /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0sea.ic:84
                #14 0x55e17b078f14 in btr_cur_search_to_nth_level_func(dict_index_t*, unsigned long, dtuple_t const*, page_cur_mode_t, unsigned long, btr_cur_t*, rw_lock_t*, char const*, unsigned int, mtr_t*, unsigned long) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0cur.cc:2483
                #15 0x55e17aeb4dab in btr_pcur_open_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0pcur.ic:441
                #16 0x55e17aeb528d in row_search_on_row_ref(btr_pcur_t*, unsigned long, dict_table_t const*, dtuple_t const*, mtr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0row.cc:1214
                #17 0x55e17ae9c9e3 in row_purge_reposition_pcur /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:78
                #18 0x55e17ae9cd3c in row_purge_reset_trx_id /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:798
                #19 0x55e17aea79dc in row_purge_record_func /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1212
                #20 0x55e17aeaa397 in row_purge /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1261
                #21 0x55e17aeaa397 in row_purge_step(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1320
                #22 0x55e17add6e27 in que_thr_step /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1038
                #23 0x55e17add6e27 in que_run_threads_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1100
                #24 0x55e17add6e27 in que_run_threads(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1140
                #25 0x55e17af22c01 in srv_task_execute /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2471
                #26 0x55e17af22c01 in srv_worker_thread /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2519
                #27 0x7f62669ea608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
            

            That looks like a race condition that causes a double-free in the MDEV-22456 code.

            marko Marko Mäkelä added a comment - In http://buildbot.askmonty.org/buildbot/builders/kvm-asan/builds/5154/steps/mtr_nm/logs/stdio there is something that could be related to this: 10.4 c2c23e598d49fc991b34853d864c77d02741b61c CURRENT_TEST: main.innodb_mrr_cpk mysqltest: At line 70: query 'select * from t1, t2 where t1.a=t2.a and t1.b=t2.b' failed: 2013: Lost connection to MySQL server during query … ==177481==ERROR: AddressSanitizer: heap-use-after-free on address 0x6170000bb5a0 at pc 0x55e179a52888 bp 0x7f62540ba920 sp 0x7f62540ba910 READ of size 8 at 0x6170000bb5a0 thread T19 #0 0x55e179a52887 in btr_search_lazy_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:309 #1 0x55e179a52a33 in btr_search_drop_page_hash_index(buf_block_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1237 #2 0x55e17b1294fb in buf_LRU_free_page(buf_page_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:1608 #3 0x55e17b12d1ea in buf_LRU_free_from_common_LRU_list /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:695 #4 0x55e17b12d1ea in buf_LRU_scan_and_free_block(buf_pool_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:737 #5 0x55e17b12e0ef in buf_LRU_get_free_block(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:966 #6 0x55e17b0bd701 in buf_block_alloc(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0buf.cc:754 #7 0x55e17b093d96 in btr_search_check_free_space_in_heap /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:198 #8 0x55e17b0a0f28 in btr_search_info_update_slow(btr_search_t*, btr_cur_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1531 #9 0x55e17b078f14 in btr_search_info_update /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0sea.ic:84 #10 0x55e17b078f14 in btr_cur_search_to_nth_level_func(dict_index_t*, unsigned long, dtuple_t const*, page_cur_mode_t, unsigned long, btr_cur_t*, rw_lock_t*, char const*, unsigned int, mtr_t*, unsigned long) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0cur.cc:2483 #11 0x55e17aeb4dab in btr_pcur_open_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0pcur.ic:441 #12 0x55e17aeb528d in row_search_on_row_ref(btr_pcur_t*, unsigned long, dict_table_t const*, dtuple_t const*, mtr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0row.cc:1214 #13 0x55e17ae9c9e3 in row_purge_reposition_pcur /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:78 #14 0x55e17ae9cd3c in row_purge_reset_trx_id /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:798 #15 0x55e17aea79dc in row_purge_record_func /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1212 #16 0x55e17aeaa397 in row_purge /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1261 #17 0x55e17aeaa397 in row_purge_step(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1320 #18 0x55e17add6e27 in que_thr_step /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1038 #19 0x55e17add6e27 in que_run_threads_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1100 #20 0x55e17add6e27 in que_run_threads(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1140 #21 0x55e17af22c01 in srv_task_execute /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2471 #22 0x55e17af22c01 in srv_worker_thread /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2519 #23 0x7f62669ea608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608) #24 0x7f626652c102 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122102)   0x6170000bb5a0 is located 288 bytes inside of 744-byte region [0x6170000bb480,0x6170000bb768) freed by thread T18 here: #0 0x7f6266b727cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf) #1 0x55e17ad4a816 in mem_heap_block_free(mem_block_info_t*, mem_block_info_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/mem/mem0mem.cc:416 #2 0x55e17b1ca232 in mem_heap_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/mem0mem.ic:417 #3 0x55e17b1ca232 in dict_mem_table_free(dict_table_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/dict/dict0mem.cc:248 #4 0x55e179a528c2 in btr_search_lazy_free /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:313 #5 0x55e179a52a33 in btr_search_drop_page_hash_index(buf_block_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1237 #6 0x55e17b1294fb in buf_LRU_free_page(buf_page_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:1608 #7 0x55e17b12d1ea in buf_LRU_free_from_common_LRU_list /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:695 #8 0x55e17b12d1ea in buf_LRU_scan_and_free_block(buf_pool_t*, bool) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:737 #9 0x55e17b12e0ef in buf_LRU_get_free_block(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0lru.cc:966 #10 0x55e17b0bd701 in buf_block_alloc(buf_pool_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/buf/buf0buf.cc:754 #11 0x55e17b093d96 in btr_search_check_free_space_in_heap /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:198 #12 0x55e17b0a0f28 in btr_search_info_update_slow(btr_search_t*, btr_cur_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0sea.cc:1531 #13 0x55e17b078f14 in btr_search_info_update /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0sea.ic:84 #14 0x55e17b078f14 in btr_cur_search_to_nth_level_func(dict_index_t*, unsigned long, dtuple_t const*, page_cur_mode_t, unsigned long, btr_cur_t*, rw_lock_t*, char const*, unsigned int, mtr_t*, unsigned long) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/btr/btr0cur.cc:2483 #15 0x55e17aeb4dab in btr_pcur_open_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/include/btr0pcur.ic:441 #16 0x55e17aeb528d in row_search_on_row_ref(btr_pcur_t*, unsigned long, dict_table_t const*, dtuple_t const*, mtr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0row.cc:1214 #17 0x55e17ae9c9e3 in row_purge_reposition_pcur /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:78 #18 0x55e17ae9cd3c in row_purge_reset_trx_id /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:798 #19 0x55e17aea79dc in row_purge_record_func /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1212 #20 0x55e17aeaa397 in row_purge /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1261 #21 0x55e17aeaa397 in row_purge_step(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/row/row0purge.cc:1320 #22 0x55e17add6e27 in que_thr_step /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1038 #23 0x55e17add6e27 in que_run_threads_low /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1100 #24 0x55e17add6e27 in que_run_threads(que_thr_t*) /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/que/que0que.cc:1140 #25 0x55e17af22c01 in srv_task_execute /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2471 #26 0x55e17af22c01 in srv_worker_thread /home/buildbot/buildbot/build/mariadb-10.4.18/storage/innobase/srv/srv0srv.cc:2519 #27 0x7f62669ea608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608) That looks like a race condition that causes a double-free in the MDEV-22456 code.
            mleich Matthias Leich added a comment - - edited

            Results of RQG testing on origin/bb-10.6-MDEV-24720 8968bd949444fe45d20e7e0b62958479c1febab4 2021-02-01T18:36:13+05:30
            1. My simplified RQG test does no more replay the assert mentioned above.
            2. The test battery for broad range functional coverage harvested also no
                 unknown bad effects.
            

            mleich Matthias Leich added a comment - - edited Results of RQG testing on origin/bb-10.6-MDEV-24720 8968bd949444fe45d20e7e0b62958479c1febab4 2021-02-01T18:36:13+05:30 1. My simplified RQG test does no more replay the assert mentioned above. 2. The test battery for broad range functional coverage harvested also no unknown bad effects.

            People

              marko Marko Mäkelä
              mleich Matthias Leich
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.