mleich found a race condition between buffer pool resizing and an update of the adaptive hash index, while testing MDEV-14425.
==3752116==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d00000d300 at pc 0x5588ff9718a7 bp 0x5038216570b0 sp 0x5038216570a0
|
READ of size 8 at 0x61d00000d300 thread T26
|
#0 0x5588ff9718a6 in buf_pool_t::is_block_field(void const*) const /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/include/buf0buf.h:1308
|
#1 0x5588ff97190a in buf_pool_t::is_uncompressed(buf_block_t const*) const /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/include/buf0buf.h:1449
|
#2 0x5588ffcd648f in btr_search_update_block_hash_info /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/btr/btr0sea.cc:415
|
The function is being called as part of a debug assertion there, so this particular failure only affects debug builds. The culprit (found by setting a hardware watchpoint on the AddressSanitizer reported poison byte and executing reverse-continue in rr) is buffer pool resizing:
Thread 50 (Thread 3752116.3794577):
|
#0 __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:200
|
#1 0x00007ff70bf479d9 in ?? () from /lib/x86_64-linux-gnu/libasan.so.5
|
#2 0x00007ff70c028799 in free () from /lib/x86_64-linux-gnu/libasan.so.5
|
#3 0x00005588ffd17b0b in buf_pool_t::resize (this=0x558901d978c0 <buf_pool>) at /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/buf/buf0buf.cc:1894
|
#4 0x00005588ffcf9ab8 in buf_resize_callback () at /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/buf/buf0buf.cc:1989
|
During the time of this, the thread that is going to fail is already executing that function:
Thread 3 (Thread 3752116.3757608):
|
#0 0x00005588ff971864 in buf_pool_t::is_block_field (this=0x558901d978c0 <buf_pool>, ptr=0x304715439930) at /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/include/buf0buf.h:1307
|
#1 0x00005588ff97190b in buf_pool_t::is_uncompressed (this=0x558901d978c0 <buf_pool>, block=0x304715439930) at /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/include/buf0buf.h:1449
|
#2 0x00005588ffcd6490 in btr_search_update_block_hash_info (info=0x61a000553a68, block=0x304715439930) at /data/Server/preview-10.8-MDEV-14425-innodbF/storage/innobase/btr/btr0sea.cc:415
|
Most invocations of buf_pool_t::is_uncompressed() are in debug assertions, and this faulty debug assertion was introduced in 10.6.
MDEV-27058 in 10.6 would allow the buf_pool.is_uncompressed(block) assertions to be rewritten simply as block->page.frame. That would be a null pointer for blocks of ROW_FORMAT=COMPRESSED tables whose uncompressed page frame has been discarded.
The calls to buf_pool.is_uncompressed() outside assertions seem to be protected correctly by buf_pool.page_hash latch. Those are in Block_hint::buffer_fix_block_if_still_valid() and buf_page_get_low().
The failing debug assertion was added in MDEV-27058.
A similar assertion had been added to mtr_t::modify() already in MDEV-22110 (MariaDB Server 10.5.5). That one is best removed.
This bug only affects debug builds during buffer pool resizing, possibly only when running with ASAN.
{"report":{"fcp":1306.7000000476837,"ttfb":297.2000000476837,"pageVisibility":"visible","entityId":106667,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{},"userDeviceMemory":8,"userDeviceProcessors":64,"apdex":0.5,"journeyId":"ffad8ebb-08b1-4f9e-9eff-6733417e9073","navigationType":0,"readyForUser":1331.6000001430511,"redirectCount":0,"resourceLoadedEnd":1308.1000001430511,"resourceLoadedStart":342.7000000476837,"resourceTiming":[{"duration":267.5,"initiatorType":"link","name":"https://jira.mariadb.org/s/2c21342762a6a02add1c328bed317ffd-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/css/_super/batch.css","startTime":342.7000000476837,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":342.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":610.2000000476837,"responseStart":0,"secureConnectionStart":0},{"duration":260.7000000476837,"initiatorType":"link","name":"https://jira.mariadb.org/s/7ebd35e77e471bc30ff0eba799ebc151-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/css/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&slack-enabled=true","startTime":349.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":349.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":610.6000001430511,"responseStart":0,"secureConnectionStart":0},{"duration":269.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/0917945aaa57108d00c5076fea35e069-CDN/lu2cib/820016/12ta74/0a8bac35585be7fc6c9cc5a0464cd4cf/_/download/contextbatch/js/_super/batch.js?locale=en","startTime":350.2999999523163,"connectEnd":350.2999999523163,"connectStart":350.2999999523163,"domainLookupEnd":350.2999999523163,"domainLookupStart":350.2999999523163,"fetchStart":350.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":350.2999999523163,"responseEnd":619.7999999523163,"responseStart":619.7999999523163,"secureConnectionStart":350.2999999523163},{"duration":338.5,"initiatorType":"script","name":"https://jira.mariadb.org/s/2d8175ec2fa4c816e8023260bd8c1786-CDN/lu2cib/820016/12ta74/2bf333562ca6724060a9d5f1535471f6/_/download/contextbatch/js/jira.browse.project,project.issue.navigator,jira.view.issue,jira.general,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en&slack-enabled=true","startTime":351.2000000476837,"connectEnd":351.2000000476837,"connectStart":351.2000000476837,"domainLookupEnd":351.2000000476837,"domainLookupStart":351.2000000476837,"fetchStart":351.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":351.2000000476837,"responseEnd":689.7000000476837,"responseStart":689.7000000476837,"secureConnectionStart":351.2000000476837},{"duration":343.7999999523163,"initiatorType":"script","name":"https://jira.mariadb.org/s/a9324d6758d385eb45c462685ad88f1d-CDN/lu2cib/820016/12ta74/c92c0caa9a024ae85b0ebdbed7fb4bd7/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en","startTime":351.40000009536743,"connectEnd":351.40000009536743,"connectStart":351.40000009536743,"domainLookupEnd":351.40000009536743,"domainLookupStart":351.40000009536743,"fetchStart":351.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":351.40000009536743,"responseEnd":695.2000000476837,"responseStart":695.1000001430511,"secureConnectionStart":351.40000009536743},{"duration":344,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":351.7000000476837,"connectEnd":351.7000000476837,"connectStart":351.7000000476837,"domainLookupEnd":351.7000000476837,"domainLookupStart":351.7000000476837,"fetchStart":351.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":351.7000000476837,"responseEnd":695.7000000476837,"responseStart":695.7000000476837,"secureConnectionStart":351.7000000476837},{"duration":344.30000019073486,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":351.7999999523163,"connectEnd":351.7999999523163,"connectStart":351.7999999523163,"domainLookupEnd":351.7999999523163,"domainLookupStart":351.7999999523163,"fetchStart":351.7999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":351.7999999523163,"responseEnd":696.1000001430511,"responseStart":696.1000001430511,"secureConnectionStart":351.7999999523163},{"duration":423.89999985694885,"initiatorType":"link","name":"https://jira.mariadb.org/s/b04b06a02d1959df322d9cded3aeecc1-CDN/lu2cib/820016/12ta74/a2ff6aa845ffc9a1d22fe23d9ee791fc/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":352.10000014305115,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":352.10000014305115,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":776,"responseStart":0,"secureConnectionStart":0},{"duration":344.90000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/rest/api/1.0/shortcuts/820016/47140b6e0a9bc2e4913da06536125810/shortcuts.js?context=issuenavigation&context=issueaction","startTime":352.2999999523163,"connectEnd":352.2999999523163,"connectStart":352.2999999523163,"domainLookupEnd":352.2999999523163,"domainLookupStart":352.2999999523163,"fetchStart":352.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":352.2999999523163,"responseEnd":697.2000000476837,"responseStart":697.2000000476837,"secureConnectionStart":352.2999999523163},{"duration":424,"initiatorType":"link","name":"https://jira.mariadb.org/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.css?jira.create.linked.issue=true","startTime":352.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":352.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":776.5,"responseStart":0,"secureConnectionStart":0},{"duration":347.40000009536743,"initiatorType":"script","name":"https://jira.mariadb.org/s/5d5e8fe91fbc506585e83ea3b62ccc4b-CDN/lu2cib/820016/12ta74/d176f0986478cc64f24226b3d20c140d/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-project.issue.navigator,-jira.view.issue/batch.js?jira.create.linked.issue=true&locale=en","startTime":352.7000000476837,"connectEnd":352.7000000476837,"connectStart":352.7000000476837,"domainLookupEnd":352.7000000476837,"domainLookupStart":352.7000000476837,"fetchStart":352.7000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":352.7000000476837,"responseEnd":700.1000001430511,"responseStart":700.1000001430511,"secureConnectionStart":352.7000000476837},{"duration":649.3000001907349,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":355.2999999523163,"connectEnd":355.2999999523163,"connectStart":355.2999999523163,"domainLookupEnd":355.2999999523163,"domainLookupStart":355.2999999523163,"fetchStart":355.2999999523163,"redirectEnd":0,"redirectStart":0,"requestStart":355.2999999523163,"responseEnd":1004.6000001430511,"responseStart":1004.6000001430511,"secureConnectionStart":355.2999999523163},{"duration":913.6000001430511,"initiatorType":"script","name":"https://jira.mariadb.org/s/d41d8cd98f00b204e9800998ecf8427e-CDN/lu2cib/820016/12ta74/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":394.5,"connectEnd":394.5,"connectStart":394.5,"domainLookupEnd":394.5,"domainLookupStart":394.5,"fetchStart":394.5,"redirectEnd":0,"redirectStart":0,"requestStart":394.5,"responseEnd":1308.1000001430511,"responseStart":1308.1000001430511,"secureConnectionStart":394.5},{"duration":206.70000004768372,"initiatorType":"xmlhttprequest","name":"https://jira.mariadb.org/rest/webResources/1.0/resources","startTime":799.2000000476837,"connectEnd":799.2000000476837,"connectStart":799.2000000476837,"domainLookupEnd":799.2000000476837,"domainLookupStart":799.2000000476837,"fetchStart":799.2000000476837,"redirectEnd":0,"redirectStart":0,"requestStart":799.2000000476837,"responseEnd":1005.9000000953674,"responseStart":1005.9000000953674,"secureConnectionStart":799.2000000476837}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":43,"responseStart":297,"responseEnd":394,"domLoading":319,"domInteractive":1400,"domContentLoadedEventStart":1400,"domContentLoadedEventEnd":1443,"domComplete":2565,"loadEventStart":2565,"loadEventEnd":2567,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[{"name":"bigPipe.sidebar-id.start","time":1378.7000000476837},{"name":"bigPipe.sidebar-id.end","time":1379.5},{"name":"bigPipe.activity-panel-pipe-id.start","time":1379.7999999523163},{"name":"bigPipe.activity-panel-pipe-id.end","time":1382},{"name":"activityTabFullyLoaded","time":1447.2999999523163}],"measures":[],"correlationId":"d12f73db836213","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":102,"dbReadsTimeInMs":14,"dbConnsTimeInMs":22,"applicationHash":"9d11dbea5f4be3d4cc21f03a88dd11d8c8687422","experiments":[]}}
Bug
Major