Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27318

SIGSEGV in row_merge_tuple_sort and Assertion `data_size < srv_sort_buf_size' failed in row_merge_bulk_buf_add on INSERT with unique_checks and foreign_key_checks disabled

    XMLWordPrintable

Details

    Description

      Interestingly not present in 10.6 optimized specifically (ref versions below). Note also MDEV-27312 which may or may not be connected.

      SET SESSION unique_checks=0,SESSION foreign_key_checks=0;
      CREATE TABLE t (f MEDIUMTEXT) ENGINE=InnoDB;
      INSERT INTO t VALUES (REPEAT(1,8459264));
      

      Leads to:

      10.7.2 979b23d5bfb11bb698ea65c9468b374978737ec0 (Optimized)

      Core was generated by `/test/MD121221-mariadb-10.7.2-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000564b0e36cc4c in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, 
          tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0)
          at /test/10.7_opt/storage/innobase/row/row0merge.cc:1023
      1023	{
      [Current thread is 1 (Thread 0x14fbadbfe700 (LWP 2435169))]
      (gdb) bt
      #0  0x0000564b0e36cc4c in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1023
      #1  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      #2  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      #3  0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      ...
      #990 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      #991 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      #992 0x0000564b0e36ccae in row_merge_tuple_sort (n_uniq=1, n_field=4, dup=0x0, tuples=0x14fb0106a228, aux=0x14fb010d5ec8, low=0, high=0) at /test/10.7_opt/storage/innobase/row/row0merge.cc:1027
      

      Same on 10.8 optimized.

      Debug:

      10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Debug)

      mysqld: /test/10.8_dbg/storage/innobase/row/row0merge.cc:506: ulint row_merge_bulk_buf_add(row_merge_buf_t*, const dict_table_t&, const dtuple_t&): Assertion `data_size < srv_sort_buf_size' failed.
      

      10.8.0 ccdf5711a8fff0cd610a91fdcf37c8ff1182878c (Debug)

      Core was generated by `/test/MD121221-mariadb-10.8.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x152d28637700 (LWP 2435869))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x0000152d3389b859 in __GI_abort () at abort.c:79
      #2  0x0000152d3389b729 in __assert_fail_base (fmt=0x152d33a31588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x5565ac7518e0 "data_size < srv_sort_buf_size", file=0x5565ac751cf8 "/test/10.8_dbg/storage/innobase/row/row0merge.cc", line=506, function=<optimized out>) at assert.c:92
      #3  0x0000152d338acf36 in __GI___assert_fail (assertion=assertion@entry=0x5565ac7518e0 "data_size < srv_sort_buf_size", file=file@entry=0x5565ac751cf8 "/test/10.8_dbg/storage/innobase/row/row0merge.cc", line=line@entry=506, function=function@entry=0x5565ac752b68 "ulint row_merge_bulk_buf_add(row_merge_buf_t*, const dict_table_t&, const dtuple_t&)") at assert.c:101
      #4  0x00005565ac0220bc in row_merge_bulk_buf_add (row=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, table=<optimized out>, buf=0x152cc5091158) at /test/10.8_dbg/storage/innobase/row/row0merge.cc:506
      #5  row_merge_bulk_t::bulk_insert_buffered (this=0x152cc50910d0, row=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, ind=@0x152cc4023dd8: {static MAX_N_FIELDS = 1023, id = 23, heap = 0x152cc4023c48, name = {m_name = 0x152cc4023f78 "GEN_CLUST_INDEX"}, table = 0x152cc40215b8, page = 3, merge_threshold = 50, type = 1, trx_id_offset = 6, n_user_defined_cols = 0, nulls_equal = 0, n_uniq = 1, n_def = 4, n_fields = 4, n_nullable = 1, n_core_fields = 4, n_core_null_bytes = 1, static NO_CORE_NULL_BYTES = 255, static DICT_INDEXES_ID = 3, cached = 1, to_be_dropped = 0, online_status = 0, uncommitted = 0, is_dummy = false, in_instant_init = false, magic_n = 76789786, fields = 0x152cc4024048, parser = 0x0, new_vcol_info = 0x0, indexes = {prev = 0x0, next = 0x0}, search_info = 0x152cc40240c8, online_log = 0x0, stat_n_diff_key_vals = 0x152cc40240b0, stat_n_sample_sizes = 0x152cc40240b8, stat_n_non_null_key_vals = 0x152cc40240c0, stat_index_size = 1, stat_n_leaf_pages = 1, stats_error_printed = false, stat_defrag_modified_counter = 0, stat_defrag_n_pages_freed = 0, stat_defrag_n_page_split = 0, stat_defrag_data_size_sample = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, stat_defrag_sample_next_slot = 0, rtr_ssn = {m = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}}, rtr_track = 0x0, trx_id = 15, zip_pad = {mutex = {<std::__mutex_base> = {_M_mutex = pthread_mutex_t = {
                    Type = Normal,
                    Status = Not acquired,
                    Robust = No,
                    Shared = No,
                    Protocol = None
                  }}, <No data fields>}, pad = {m = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}}, success = 0, failure = 0, n_rounds = 0}, lock = {lock = {pfs_psi = 0x0, lock = {writer = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static WRITER = 2147483648}}, recursive = 0, writer = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}, static FOR_IO = 18446744073709551615, readers_lock = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {_M_b = {_M_p = 0x152cc4025b20}}, static RECURSIVE_X = 1, static RECURSIVE_U = 65536, static RECURSIVE_MAX = 65535}}, trx=trx@entry=0x152d2a6cf1e0) at /test/10.8_dbg/storage/innobase/row/row0merge.cc:5125
      #6  0x00005565ac0c7a24 in trx_mod_table_time_t::bulk_insert_buffered (trx=0x152d2a6cf1e0, index=@0x152cc4023dd8: {static MAX_N_FIELDS = 1023, id = 23, heap = 0x152cc4023c48, name = {m_name = 0x152cc4023f78 "GEN_CLUST_INDEX"}, table = 0x152cc40215b8, page = 3, merge_threshold = 50, type = 1, trx_id_offset = 6, n_user_defined_cols = 0, nulls_equal = 0, n_uniq = 1, n_def = 4, n_fields = 4, n_nullable = 1, n_core_fields = 4, n_core_null_bytes = 1, static NO_CORE_NULL_BYTES = 255, static DICT_INDEXES_ID = 3, cached = 1, to_be_dropped = 0, online_status = 0, uncommitted = 0, is_dummy = false, in_instant_init = false, magic_n = 76789786, fields = 0x152cc4024048, parser = 0x0, new_vcol_info = 0x0, indexes = {prev = 0x0, next = 0x0}, search_info = 0x152cc40240c8, online_log = 0x0, stat_n_diff_key_vals = 0x152cc40240b0, stat_n_sample_sizes = 0x152cc40240b8, stat_n_non_null_key_vals = 0x152cc40240c0, stat_index_size = 1, stat_n_leaf_pages = 1, stats_error_printed = false, stat_defrag_modified_counter = 0, stat_defrag_n_pages_freed = 0, stat_defrag_n_page_split = 0, stat_defrag_data_size_sample = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, stat_defrag_sample_next_slot = 0, rtr_ssn = {m = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}}, rtr_track = 0x0, trx_id = 15, zip_pad = {mutex = {<std::__mutex_base> = {_M_mutex = pthread_mutex_t = {
                    Type = Normal,
                    Status = Not acquired,
                    Robust = No,
                    Shared = No,
                    Protocol = None
                  }}, <No data fields>}, pad = {m = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}}, success = 0, failure = 0, n_rounds = 0}, lock = {lock = {pfs_psi = 0x0, lock = {writer = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static WRITER = 2147483648}}, recursive = 0, writer = {<std::__atomic_base<unsigned long>> = {static _S_alignment = 8, _M_i = 0}, <No data fields>}, static FOR_IO = 18446744073709551615, readers_lock = {lock = {<std::__atomic_base<unsigned int>> = {static _S_alignment = 4, _M_i = 0}, <No data fields>}, static HOLDER = 2147483648}, readers = {_M_b = {_M_p = 0x152cc4025b20}}, static RECURSIVE_X = 1, static RECURSIVE_U = 65536, static RECURSIVE_MAX = 65535}}, entry=@0x152cc4023828: {info_bits = 0, n_fields = 4, n_fields_cmp = 1, fields = 0x152cc4023860, n_v_fields = 0, v_fields = 0x0, magic_n = 65478679}, this=0x152cc4023650) at /test/10.8_dbg/storage/innobase/include/trx0trx.h:510
      #7  trx_undo_report_row_operation (thr=thr@entry=0x152cc4029848, index=index@entry=0x152cc4023dd8, clust_entry=clust_entry@entry=0x152cc4023828, update=update@entry=0x0, cmpl_info=cmpl_info@entry=0, rec=rec@entry=0x0, offsets=0x0, roll_ptr=0x0) at /test/10.8_dbg/storage/innobase/trx/trx0rec.cc:2061
      #8  0x00005565ac00ae27 in row_ins_clust_index_entry_low (flags=flags@entry=0, mode=<optimized out>, mode@entry=2, index=index@entry=0x152cc4023dd8, n_uniq=n_uniq@entry=0, entry=entry@entry=0x152cc4023828, n_ext=n_ext@entry=0, thr=<optimized out>) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:2674
      #9  0x00005565ac00cf20 in row_ins_clust_index_entry (index=index@entry=0x152cc4023dd8, entry=entry@entry=0x152cc4023828, thr=thr@entry=0x152cc4029848, n_ext=n_ext@entry=0) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3246
      #10 0x00005565ac011d2d in row_ins_index_entry (thr=0x152cc4029848, entry=0x152cc4023828, index=0x152cc4023dd8) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3380
      #11 row_ins_index_entry_step (thr=0x152cc4029848, node=0x152cc4029628) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3548
      #12 row_ins (thr=0x152cc4029848, node=0x152cc4029628) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3694
      #13 row_ins_step (thr=thr@entry=0x152cc4029848) at /test/10.8_dbg/storage/innobase/row/row0ins.cc:3840
      #14 0x00005565ac035b32 in row_insert_for_mysql (mysql_rec=mysql_rec@entry=0x152cc4028458 "\376", prebuilt=0x152cc4029138, ins_mode=ROW_INS_NORMAL) at /test/10.8_dbg/storage/innobase/row/row0mysql.cc:1318
      #15 0x00005565abeb12b7 in ha_innobase::write_row (this=0x152cc40288e0, record=0x152cc4028458 "\376") at /test/10.8_dbg/storage/innobase/handler/ha_innodb.cc:7823
      #16 0x00005565abb017d7 in handler::ha_write_row (this=0x152cc40288e0, buf=0x152cc4028458 "\376") at /test/10.8_dbg/sql/handler.cc:7516
      #17 0x00005565ab7a006a in write_record (thd=thd@entry=0x152cc4000db8, table=table@entry=0x152cc4028008, info=info@entry=0x152d28635ca0, sink=sink@entry=0x0) at /test/10.8_dbg/sql/sql_insert.cc:2156
      #18 0x00005565ab7abcd9 in mysql_insert (thd=thd@entry=0x152cc4000db8, table_list=0x152cc4013ec8, fields=@0x152cc4006078: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc4006078, elements = 0}, <No data fields>}, values_list=@0x152cc40060c0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152cc4014c50, last = 0x152cc4014c50, elements = 1}, <No data fields>}, update_fields=@0x152cc40060a8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc40060a8, elements = 0}, <No data fields>}, update_values=@0x152cc4006090: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x5565ace26b00 <end_of_list>, last = 0x152cc4006090, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false, result=0x0) at /test/10.8_dbg/sql/sql_insert.cc:1127
      #19 0x00005565ab7f23d3 in mysql_execute_command (thd=thd@entry=0x152cc4000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.8_dbg/sql/sql_parse.cc:4563
      #20 0x00005565ab7dce0f in mysql_parse (thd=thd@entry=0x152cc4000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152d28636400) at /test/10.8_dbg/sql/sql_parse.cc:8028
      #21 0x00005565ab7ebaab in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152cc4000db8, packet=packet@entry=0x152cc400b879 "INSERT INTO t VALUES (REPEAT(1,8459264))", packet_length=packet_length@entry=40, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_class.h:1360
      #22 0x00005565ab7eeeea in do_command (thd=0x152cc4000db8, blocking=blocking@entry=true) at /test/10.8_dbg/sql/sql_parse.cc:1402
      #23 0x00005565ab96889c in do_handle_one_connection (connect=<optimized out>, connect@entry=0x5565afa5ba08, put_in_cache=put_in_cache@entry=true) at /test/10.8_dbg/sql/sql_connect.cc:1418
      #24 0x00005565ab968ea1 in handle_one_connection (arg=arg@entry=0x5565afa5ba08) at /test/10.8_dbg/sql/sql_connect.cc:1312
      #25 0x00005565abdea442 in pfs_spawn_thread (arg=0x5565af96d608) at /test/10.8_dbg/storage/perfschema/pfs.cc:2201
      #26 0x0000152d33daa609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #27 0x0000152d33998293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.6.6 (dbg), 10.7.2 (dbg), 10.7.2 (opt), 10.8.0 (dbg), 10.8.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

      Attachments

        Issue Links

          Activity

            People

              mleich Matthias Leich
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.