Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-26583

SIGSEGV's in spider_get_select_limit_from_select_lex when DELAYED INSERT is used

Details

    Description

      Repeat till it crashes. Sporadic or delayed due to INSERT DELAYED.

      DROP DATABASE test;
      CREATE DATABASE test;
      USE test;
      INSTALL PLUGIN spider SONAME 'ha_spider.so';
      CREATE SERVER d FOREIGN DATA WRAPPER mysql OPTIONS (HOST'',DATABASE'',USER'',PORT 10000,PASSWORD'');
      SET SESSION spider_same_server_link=ON;
      CREATE TABLE t (c INT AUTO_INCREMENT KEY,c2 INT,INDEX i (c2)) ENGINE=SPIDER ROW_FORMAT=COMPRESSED;
      INSERT DELAYED INTO t VALUES (0,0),(0,0),(0,0);
      SELECT SLEEP (3);
      

      Leads to:

      10.7.0 1bc82aaf0a7746c0921a94034aff2d51f0d75cd0 (Debug)

      Core was generated by `/test/MD040921-mariadb-10.7.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000014a4b2f06e9d in spider_get_select_limit_from_select_lex (
          select_lex=0x14a484014468, select_limit=select_limit@entry=0x14a4c010ab90, 
          offset_limit=offset_limit@entry=0x14a4c010ab98)
          at /test/10.7_dbg/storage/spider/spd_table.cc:8967
      [Current thread is 1 (Thread 0x14a4c010c700 (LWP 585154))]
      (gdb) bt
      #0  0x000014a4b2f06e9d in spider_get_select_limit_from_select_lex (select_lex=0x14a484014468, select_limit=select_limit@entry=0x14a4c010ab90, offset_limit=offset_limit@entry=0x14a4c010ab98) at /test/10.7_dbg/storage/spider/spd_table.cc:8967
      #1  0x000014a4b2f06f59 in spider_get_select_limit (spider=spider@entry=0x14a430005010, select_lex=select_lex@entry=0x14a4c010ab88, select_limit=select_limit@entry=0x14a4c010ab90, offset_limit=offset_limit@entry=0x14a4c010ab98) at /test/10.7_dbg/storage/spider/spd_table.cc:8983
      #2  0x000014a4b2f070d0 in spider_split_read_param (spider=spider@entry=0x14a430005010) at /test/10.7_dbg/storage/spider/spd_table.cc:9020
      #3  0x000014a4b2f07903 in spider_set_result_list_param (spider=spider@entry=0x14a430005010) at /test/10.7_dbg/storage/spider/spd_table.cc:8439
      #4  0x000014a4b2f554ab in ha_spider::index_init (this=this@entry=0x14a430005010, idx=0, sorted=sorted@entry=true) at /test/10.7_dbg/storage/spider/ha_spider.cc:1778
      #5  0x000014a4b2f55714 in ha_spider::get_auto_increment (this=0x14a430005010, offset=<optimized out>, increment=1, nb_desired_values=1, first_value=0x14a4c010b990, nb_reserved_values=0x14a4c010b998) at /test/10.7_dbg/storage/spider/ha_spider.cc:9800
      #6  0x0000555b9fd59227 in handler::update_auto_increment (this=this@entry=0x14a430005010) at /test/10.7_dbg/sql/handler.cc:3954
      #7  0x000014a4b2f3b52c in ha_spider::update_auto_increment (this=this@entry=0x14a430005010) at /test/10.7_dbg/storage/spider/ha_spider.cc:9755
      #8  0x000014a4b2f574f3 in ha_spider::write_row (this=0x14a430005010, buf=0x14a430004b88 <incomplete sequence \375>) at /test/10.7_dbg/storage/spider/ha_spider.cc:10014
      #9  0x0000555b9fd610b5 in handler::ha_write_row (this=0x14a430005010, buf=0x14a430004b88 <incomplete sequence \375>) at /test/10.7_dbg/sql/handler.cc:7514
      #10 0x0000555b9fa0533a in write_record (thd=thd@entry=0x14a48409c948, table=0x14a430001cc8, info=info@entry=0x14a4840a35e8, sink=sink@entry=0x0) at /test/10.7_dbg/sql/sql_insert.cc:2135
      #11 0x0000555b9fa07e0c in Delayed_insert::handle_inserts (this=this@entry=0x14a48409c928) at /test/10.7_dbg/sql/sql_insert.cc:3576
      #12 0x0000555b9fa09885 in handle_delayed_insert (arg=arg@entry=0x14a48409c928) at /test/10.7_dbg/sql/sql_insert.cc:3316
      #13 0x0000555ba0033ade in pfs_spawn_thread (arg=0x555ba32c7418) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
      #14 0x000014a4d64db609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #15 0x000014a4d60c9293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.22 (dbg), 10.5.13 (dbg), 10.6.5 (dbg), 10.7.0 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.41 (dbg), 10.2.41 (opt), 10.3.32 (dbg), 10.3.32 (opt), 10.4.22 (opt), 10.5.13 (opt), 10.6.5 (opt), 10.7.0 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.35 (dbg), 5.7.35 (opt), 8.0.26 (dbg), 8.0.26 (opt)

      Attachments

        Issue Links

          Activity

            Likely a newer one. Spider created a transaction, wanted to commit, but XID was 0, because it was generated from query_id, and delayed thread never set a query id.

            If it doesn't crash — I suggest to ignore it for now, and fix it when it starts crashing after a merge up.

            Just don't forget to add a test that insert delayed actually does work. inserts rows. that end up in a table.

            serg Sergei Golubchik added a comment - Likely a newer one. Spider created a transaction, wanted to commit, but XID was 0, because it was generated from query_id, and delayed thread never set a query id. If it doesn't crash — I suggest to ignore it for now, and fix it when it starts crashing after a merge up. Just don't forget to add a test that insert delayed actually does work. inserts rows. that end up in a table.

            serg OK. Thank you!

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - serg OK. Thank you!
            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - - edited holyfoot I updated the test case according to Sergei's comment: https://github.com/MariaDB/server/commit/94637a0c76f6fcf2169ecc7fb790aee139931d4e

            ok to push.

            holyfoot Alexey Botchkov added a comment - ok to push.
            Roel Roel Van de Paar added a comment - - edited

            Adding for completeness. After MDEV-27240 fix, and prior to the fix in this ticket, things for this bug became a little clearer.

            INSTALL PLUGIN spider SONAME 'ha_spider.so';
            CREATE TABLE t1 (c0 INT,UNIQUE (c0) USING HASH) ENGINE=SPIDER;
            INSERT DELAYED INTO t1 VALUES (0);
            invalid;
            SELECT SLEEP (1);
            

            Will produce:

            SIGSEGV|spider_get_select_limit_from_select_lex|spider_get_select_limit|spider_split_read_param|spider_set_result_list_param
            

            As per the original stack above. And the following stack was also observed with this testcase, and/or this similar one:

            INSTALL PLUGIN spider SONAME 'ha_spider.so';
            DROP TABLE t1;
            SET sql_mode='';
            CREATE TABLE t1 (pk0 INT,pk1 CHAR(1),c0 INT,UNIQUE (c0) USING HASH) ENGINE=SPIDER;
            INSERT DELAYED INTO t1 VALUES (3,'','');
            SELECT ST_EQUALS (g,ST_GEOMFROMTEXT (@clection_elems_1)) FROM gis_geometryclection WHERE fid=114;
            

            SIGSEGV|spider_check_index_merge|spider_check_direct_order_limit|ha_spider::check_direct_order_limit|ha_spider::check_direct_order_limit
            

            Roel Roel Van de Paar added a comment - - edited Adding for completeness. After MDEV-27240 fix, and prior to the fix in this ticket, things for this bug became a little clearer. INSTALL PLUGIN spider SONAME 'ha_spider.so' ; CREATE TABLE t1 (c0 INT , UNIQUE (c0) USING HASH) ENGINE=SPIDER; INSERT DELAYED INTO t1 VALUES (0); invalid; SELECT SLEEP (1); Will produce: SIGSEGV|spider_get_select_limit_from_select_lex|spider_get_select_limit|spider_split_read_param|spider_set_result_list_param As per the original stack above. And the following stack was also observed with this testcase, and/or this similar one: INSTALL PLUGIN spider SONAME 'ha_spider.so' ; DROP TABLE t1; SET sql_mode= '' ; CREATE TABLE t1 (pk0 INT ,pk1 CHAR (1),c0 INT , UNIQUE (c0) USING HASH) ENGINE=SPIDER; INSERT DELAYED INTO t1 VALUES (3, '' , '' ); SELECT ST_EQUALS (g,ST_GEOMFROMTEXT (@clection_elems_1)) FROM gis_geometryclection WHERE fid=114; SIGSEGV|spider_check_index_merge|spider_check_direct_order_limit|ha_spider::check_direct_order_limit|ha_spider::check_direct_order_limit

            People

              nayuta-yanagisawa Nayuta Yanagisawa (Inactive)
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.