Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27894

Spider: SIGSEGV in __memmove_avx_unaligned_erms (from memcpy in handler::check_duplicate_long_entry_key) and Assertion `inited == NONE || lookup_handler != this' failed on INSERT DELAYED

Details

    Description

      INSTALL PLUGIN spider SONAME 'ha_spider.so';
      CREATE TABLE t (a INT UNSIGNED KEY,b INT UNSIGNED,c INT UNSIGNED,UNIQUE (b,c) USING HASH) ENGINE=SPIDER;
      SHOW CREATE TABLE t;
      INSERT DELAYED INTO t VALUES (0,0,0);
      

      Leads to:

      10.9.0 b5852ffbeebc3000982988383daeefb0549e058a (Optimized)

      Core was generated by `/test/MD140222-mariadb-10.9.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  __memmove_avx_unaligned_erms ()
          at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:306
      [Current thread is 1 (Thread 0x148f5c1de700 (LWP 2298967))]
      (gdb) bt
      #0  __memmove_avx_unaligned_erms () at ../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:306
      #1  0x000055afeae932b9 in memcpy (__len=<optimized out>, __src=<optimized out>, __dest=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
      #2  handler::check_duplicate_long_entry_key (this=this@entry=0x148ef8023810, new_rec=new_rec@entry=0x148ef8047a18 <incomplete sequence \361>, key_no=key_no@entry=1) at /test/10.9_opt/sql/handler.cc:7171
      #3  0x000055afeae9357a in handler::check_duplicate_long_entries (this=this@entry=0x148ef8023810, new_rec=new_rec@entry=0x148ef8047a18 <incomplete sequence \361>) at /test/10.9_opt/sql/handler.cc:7252
      #4  0x000055afeae93d7d in handler::ha_write_row (this=0x148ef8023810, buf=0x148ef8047a18 <incomplete sequence \361>) at /test/10.9_opt/sql/handler.cc:7514
      #5  0x000055afeabfd0fd in write_record (thd=thd@entry=0x148ef80619d8, table=0x148ef8048428, info=info@entry=0x148ef80683b8, sink=sink@entry=0x0) at /test/10.9_opt/sql/sql_insert.cc:2156
      #6  0x000055afeabffb2d in Delayed_insert::handle_inserts (this=0x148ef80619b8) at /test/10.9_opt/sql/sql_insert.cc:3605
      #7  0x000055afeac07145 in handle_delayed_insert (arg=arg@entry=0x148ef80619b8) at /test/10.9_opt/sql/sql_insert.cc:3345
      #8  0x000055afeb0d57b1 in pfs_spawn_thread (arg=0x55afeebf3a78) at /test/10.9_opt/storage/perfschema/pfs.cc:2201
      #9  0x0000148f7f333609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #10 0x0000148f7ef21293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.7.2 3351dfaab0599268eaf25f9d6995ef128910a8b9 (Debug)

      mysqld: /test/10.7_dbg/sql/handler.cc:7507: int handler::ha_write_row(const uchar*): Assertion `inited == NONE || lookup_handler != this' failed.
      

      10.7.2 3351dfaab0599268eaf25f9d6995ef128910a8b9 (Debug)

      Core was generated by `/test/MD290122-mariadb-10.7.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x14eaf65ee700 (LWP 2300708))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x000014eb1b4e5859 in __GI_abort () at abort.c:79
      #2  0x000014eb1b4e5729 in __assert_fail_base (fmt=0x14eb1b67b588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55ef7b378580 "inited == NONE || lookup_handler != this", file=0x55ef7b375003 "/test/10.7_dbg/sql/handler.cc", line=7507, function=<optimized out>) at assert.c:92
      #3  0x000014eb1b4f6f36 in __GI___assert_fail (assertion=assertion@entry=0x55ef7b378580 "inited == NONE || lookup_handler != this", file=file@entry=0x55ef7b375003 "/test/10.7_dbg/sql/handler.cc", line=line@entry=7507, function=function@entry=0x55ef7b378558 "int handler::ha_write_row(const uchar*)") at assert.c:101
      #4  0x000055ef7a824ad8 in handler::ha_write_row (this=0x14eaa802f360, buf=0x14eaa802eed8 <incomplete sequence \361>) at /test/10.7_dbg/sql/handler.cc:7507
      #5  0x000055ef7a4c4160 in write_record (thd=thd@entry=0x14eaa809a298, table=0x14eaa8061bd8, info=info@entry=0x14eaa80a1038, sink=sink@entry=0x0) at /test/10.7_dbg/sql/sql_insert.cc:2156
      #6  0x000055ef7a4c6c32 in Delayed_insert::handle_inserts (this=this@entry=0x14eaa809a278) at /test/10.7_dbg/sql/sql_insert.cc:3597
      #7  0x000055ef7a4c86ab in handle_delayed_insert (arg=arg@entry=0x14eaa809a278) at /test/10.7_dbg/sql/sql_insert.cc:3337
      #8  0x000055ef7ab0d8b0 in pfs_spawn_thread (arg=0x55ef7d4de8f8) at /test/10.7_dbg/storage/perfschema/pfs.cc:2201
      #9  0x000014eb1b9f4609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #10 0x000014eb1b5e2293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.23 (dbg), 10.4.23 (opt), 10.5.14 (dbg), 10.5.14 (opt), 10.6.6 (dbg), 10.7.2 (dbg), 10.7.2 (opt), 10.8.1 (dbg), 10.8.1 (opt), 10.9.0 (dbg), 10.9.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.42 (dbg), 10.2.42 (opt), 10.3.33 (dbg), 10.3.33 (opt), 10.6.6 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.36 (dbg), 5.7.36 (opt), 8.0.27 (dbg), 8.0.27 (opt)

      Attachments

        Issue Links

          Activity

            Roel Roel Van de Paar added a comment - - edited

            As perhaps expected, and otherwise unrelated to this bug it seems, 10.4 (only) crashes with the MDEV-22525 stack.

            10.4.23 12cad0c3468d734e041d4ef0cd5a26d2a28606fc (Debug)

            Core was generated by `/test/MD290122-mariadb-10.4.23-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x000056320e9bfb17 in check_vcol_forward_refs (field=field@entry=
                0x1525bc015b38, vcol=0x1525bc015c10, 
                check_constraint=check_constraint@entry=false)
                at /test/10.4_dbg/sql/table.cc:3506
            [Current thread is 1 (Thread 0x152610182700 (LWP 2286557))]
            (gdb) bt
            #0  0x000056320e9bfb17 in check_vcol_forward_refs (field=field@entry=0x1525bc015b38, vcol=0x1525bc015c10, check_constraint=check_constraint@entry=false) at /test/10.4_dbg/sql/table.cc:3506
            #1  0x000056320e9c47d9 in parse_vcol_defs (thd=thd@entry=0x1525bc000d90, mem_root=0x1525bc006768, table=table@entry=0x1525bc014a80, error_reported=error_reported@entry=0x15261017f540, mode=mode@entry=VCOL_INIT_DEPENDENCY_FAILURE_IS_WARNING) at /test/10.4_dbg/sql/table.cc:1304
            #2  0x000056320e87df8e in Delayed_insert::get_local_table (this=this@entry=0x1525bc0a1970, client_thd=client_thd@entry=0x1525bc000d90) at /test/10.4_dbg/sql/sql_insert.cc:2673
            #3  0x000056320e886d28 in delayed_get_table (table_list=0x1525bc013328, grl_protection_request=0x15261017f690, thd=0x1525bc000d90) at /test/10.4_dbg/sql/sql_insert.cc:2502
            #4  open_and_lock_for_insert_delayed (thd=thd@entry=0x1525bc000d90, table_list=table_list@entry=0x1525bc013328) at /test/10.4_dbg/sql/sql_insert.cc:573
            #5  0x000056320e88740f in mysql_insert (thd=thd@entry=0x1525bc000d90, table_list=0x1525bc013328, fields=@0x1525bc005ba0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005ba0, elements = 0}, <No data fields>}, values_list=@0x1525bc005be8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1525bc014090, last = 0x1525bc014090, elements = 1}, <No data fields>}, update_fields=@0x1525bc005bd0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005bd0, elements = 0}, <No data fields>}, update_values=@0x1525bc005bb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005bb8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false) at /test/10.4_dbg/sql/sql_insert.cc:759
            #6  0x000056320e8c3cc1 in mysql_execute_command (thd=thd@entry=0x1525bc000d90) at /test/10.4_dbg/sql/sql_parse.cc:4598
            #7  0x000056320e8cba83 in mysql_parse (thd=thd@entry=0x1525bc000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152610181490, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7995
            #8  0x000056320e8ce4df in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1525bc000d90, packet=packet@entry=0x1525bc01a361 "INSERT DELAYED INTO t VALUES (0,0,0)", packet_length=packet_length@entry=36, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1201
            #9  0x000056320e8d1dd2 in do_command (thd=0x1525bc000d90) at /test/10.4_dbg/sql/sql_parse.cc:1373
            #10 0x000056320ea10cb3 in do_handle_one_connection (connect=connect@entry=0x56321273c100) at /test/10.4_dbg/sql/sql_connect.cc:1420
            #11 0x000056320ea10dd2 in handle_one_connection (arg=0x56321273c100) at /test/10.4_dbg/sql/sql_connect.cc:1316
            #12 0x000015262676f609 in start_thread (arg=<optimized out>) at pthread_create.c:477
            #13 0x000015262635d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
            

            Roel Roel Van de Paar added a comment - - edited As perhaps expected, and otherwise unrelated to this bug it seems, 10.4 (only) crashes with the MDEV-22525 stack. 10.4.23 12cad0c3468d734e041d4ef0cd5a26d2a28606fc (Debug) Core was generated by `/test/MD290122-mariadb-10.4.23-linux-x86_64-dbg/bin/mysqld --no-defaults --core'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000056320e9bfb17 in check_vcol_forward_refs (field=field@entry= 0x1525bc015b38, vcol=0x1525bc015c10, check_constraint=check_constraint@entry=false) at /test/10.4_dbg/sql/table.cc:3506 [Current thread is 1 (Thread 0x152610182700 (LWP 2286557))] (gdb) bt #0 0x000056320e9bfb17 in check_vcol_forward_refs (field=field@entry=0x1525bc015b38, vcol=0x1525bc015c10, check_constraint=check_constraint@entry=false) at /test/10.4_dbg/sql/table.cc:3506 #1 0x000056320e9c47d9 in parse_vcol_defs (thd=thd@entry=0x1525bc000d90, mem_root=0x1525bc006768, table=table@entry=0x1525bc014a80, error_reported=error_reported@entry=0x15261017f540, mode=mode@entry=VCOL_INIT_DEPENDENCY_FAILURE_IS_WARNING) at /test/10.4_dbg/sql/table.cc:1304 #2 0x000056320e87df8e in Delayed_insert::get_local_table (this=this@entry=0x1525bc0a1970, client_thd=client_thd@entry=0x1525bc000d90) at /test/10.4_dbg/sql/sql_insert.cc:2673 #3 0x000056320e886d28 in delayed_get_table (table_list=0x1525bc013328, grl_protection_request=0x15261017f690, thd=0x1525bc000d90) at /test/10.4_dbg/sql/sql_insert.cc:2502 #4 open_and_lock_for_insert_delayed (thd=thd@entry=0x1525bc000d90, table_list=table_list@entry=0x1525bc013328) at /test/10.4_dbg/sql/sql_insert.cc:573 #5 0x000056320e88740f in mysql_insert (thd=thd@entry=0x1525bc000d90, table_list=0x1525bc013328, fields=@0x1525bc005ba0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005ba0, elements = 0}, <No data fields>}, values_list=@0x1525bc005be8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1525bc014090, last = 0x1525bc014090, elements = 1}, <No data fields>}, update_fields=@0x1525bc005bd0: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005bd0, elements = 0}, <No data fields>}, update_values=@0x1525bc005bb8: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x56320fe95ca0 <end_of_list>, last = 0x1525bc005bb8, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false) at /test/10.4_dbg/sql/sql_insert.cc:759 #6 0x000056320e8c3cc1 in mysql_execute_command (thd=thd@entry=0x1525bc000d90) at /test/10.4_dbg/sql/sql_parse.cc:4598 #7 0x000056320e8cba83 in mysql_parse (thd=thd@entry=0x1525bc000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152610181490, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7995 #8 0x000056320e8ce4df in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1525bc000d90, packet=packet@entry=0x1525bc01a361 "INSERT DELAYED INTO t VALUES (0,0,0)", packet_length=packet_length@entry=36, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1201 #9 0x000056320e8d1dd2 in do_command (thd=0x1525bc000d90) at /test/10.4_dbg/sql/sql_parse.cc:1373 #10 0x000056320ea10cb3 in do_handle_one_connection (connect=connect@entry=0x56321273c100) at /test/10.4_dbg/sql/sql_connect.cc:1420 #11 0x000056320ea10dd2 in handle_one_connection (arg=0x56321273c100) at /test/10.4_dbg/sql/sql_connect.cc:1316 #12 0x000015262676f609 in start_thread (arg=<optimized out>) at pthread_create.c:477 #13 0x000015262635d293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

            I've confirmed that the bug is reproducible on 10.4 but not 10.3.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - I've confirmed that the bug is reproducible on 10.4 but not 10.3.

            MTR test case

            > cat storage/spider/mysql-test/spider/bugfix/t/mdev_27894.cnf
            !include include/default_mysqld.cnf
            !include ../my_1_1.cnf
            

            > cat storage/spider/mysql-test/spider/bugfix/t/mdev_27894.test 
            --echo #
            --echo # MDEV-27894 Spider: SIGSEGV in __memmove_avx_unaligned_erms (from memcpy in handler::check_duplicate_long_entry_key)
            --echo # and Assertion `inited == NONE || lookup_handler != this' failed on INSERT DELAYED
            --echo #
             
            --disable_query_log
            --disable_result_log
            --source ../../t/test_init.inc
            --enable_result_log
            --enable_query_log
             
            --connection master_1
            CREATE DATABASE auto_test_remote;
            USE auto_test_remote;
             
            CREATE TABLE tbl_a (a INT UNSIGNED KEY,b INT UNSIGNED,c INT UNSIGNED,UNIQUE (b, c) USING HASH) ENGINE=SPIDER;
            SHOW CREATE TABLE tbl_a;
            INSERT DELAYED INTO tbl_a VALUES (0,0,0);
             
            DROP DATABASE auto_test_remote;
             
            --disable_query_log
            --disable_result_log
            --source ../../t/test_deinit.inc
            --enable_result_log
            --enable_query_log
            

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - MTR test case > cat storage/spider/mysql-test/spider/bugfix/t/mdev_27894.cnf !include include/default_mysqld.cnf !include ../my_1_1.cnf > cat storage/spider/mysql-test/spider/bugfix/t/mdev_27894.test --echo # --echo # MDEV-27894 Spider: SIGSEGV in __memmove_avx_unaligned_erms (from memcpy in handler::check_duplicate_long_entry_key) --echo # and Assertion `inited == NONE || lookup_handler != this' failed on INSERT DELAYED --echo #   --disable_query_log --disable_result_log --source ../../t/test_init.inc --enable_result_log --enable_query_log   --connection master_1 CREATE DATABASE auto_test_remote; USE auto_test_remote;   CREATE TABLE tbl_a (a INT UNSIGNED KEY,b INT UNSIGNED,c INT UNSIGNED,UNIQUE (b, c) USING HASH) ENGINE=SPIDER; SHOW CREATE TABLE tbl_a; INSERT DELAYED INTO tbl_a VALUES (0,0,0);   DROP DATABASE auto_test_remote;   --disable_query_log --disable_result_log --source ../../t/test_deinit.inc --enable_result_log --enable_query_log

            I guess the problems on 10.4 and 10.5 are different. So, I will create a separate issue for 10.4.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - I guess the problems on 10.4 and 10.5 are different. So, I will create a separate issue for 10.4.

            On 10.5.0, the server crashes with the stack that looks quite similar to the one on 10.4.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - On 10.5.0, the server crashes with the stack that looks quite similar to the one on 10.4.

            INSERT DELAYED is no longer allowed on Spider tables because of MDEV-28854.

            nayuta-yanagisawa Nayuta Yanagisawa (Inactive) added a comment - INSERT DELAYED is no longer allowed on Spider tables because of MDEV-28854 .

            People

              nayuta-yanagisawa Nayuta Yanagisawa (Inactive)
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.