Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-27973

SIGSEGV in ha_innobase::reset from THD::mark_tmp_table_as_free_for_reuse (opt builds) and handler::ha_reset (dbg builds) on TRUNCATE

Details

    Description

      SET SESSION innodb_compression_default=1;
      		 
      CREATE TEMPORARY TABLE t (c INT,c2 INT,c3 INT,KEY(c)) ENGINE=InnoDB;
      		 
      SET GLOBAL innodb_compression_level=0;
      		 
      TRUNCATE t;

      Leads to:

      10.9.0 4a2a9c02cd6611ef36bbb735c2b483dbc83580d4 (Optimized)

      		 
      Core was generated by `/test/MD260222-mariadb-10.9.0-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x000055c0c193d6a7 in ha_innobase::reset (this=0x14db9401d4a0)
      		 
          at /test/10.9_opt/storage/innobase/handler/ha_innodb.cc:15735
      		 
      [Current thread is 1 (Thread 0x14dc6813c700 (LWP 325037))]
      		 
      (gdb) bt
      		 
      #0  0x000055c0c193d6a7 in ha_innobase::reset (this=0x14db9401d4a0) at /test/10.9_opt/storage/innobase/handler/ha_innodb.cc:15735
      		 
      #1  0x000055c0c15cde54 in THD::mark_tmp_table_as_free_for_reuse (this=this@entry=0x14db94000c58, table=0x14db940180d8) at /test/10.9_opt/sql/temporary_tables.cc:791
      		 
      #2  0x000055c0c15cf101 in THD::mark_tmp_tables_as_free_for_reuse (this=this@entry=0x14db94000c58) at /test/10.9_opt/sql/temporary_tables.cc:753
      		 
      #3  0x000055c0c138e978 in close_thread_tables (thd=thd@entry=0x14db94000c58) at /test/10.9_opt/sql/sql_base.cc:865
      		 
      #4  0x000055c0c1404269 in mysql_execute_command (thd=0x14db94000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:6054
      		 
      #5  0x000055c0c13f4e26 in mysql_parse (thd=0x14db94000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.9_opt/sql/sql_parse.cc:8027
      		 
      #6  0x000055c0c1400fd5 in dispatch_command (command=COM_QUERY, thd=0x14db94000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.9_opt/sql/sql_class.h:1362
      		 
      #7  0x000055c0c14031c7 in do_command (thd=0x14db94000c58, blocking=blocking@entry=true) at /test/10.9_opt/sql/sql_parse.cc:1402
      		 
      #8  0x000055c0c1522b47 in do_handle_one_connection (connect=<optimized out>, put_in_cache=true) at /test/10.9_opt/sql/sql_connect.cc:1418
      		 
      #9  0x000055c0c1522e8d in handle_one_connection (arg=arg@entry=0x55c0c3c34848) at /test/10.9_opt/sql/sql_connect.cc:1312
      		 
      #10 0x000055c0c189c631 in pfs_spawn_thread (arg=0x55c0c3bc99a8) at /test/10.9_opt/storage/perfschema/pfs.cc:2201
      		 
      #11 0x000014dc74675609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      		 
      #12 0x000014dc74263293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      10.9.0 4a2a9c02cd6611ef36bbb735c2b483dbc83580d4 (Debug)

      		 
      Core was generated by `/test/MD260222-mariadb-10.9.0-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x000055a26671562b in ha_innobase::reset (this=0x14eab8022a10)
      		 
          at /test/10.9_dbg/storage/innobase/handler/ha_innodb.cc:15735
      		 
      [Current thread is 1 (Thread 0x14eb200ef700 (LWP 325591))]
      		 
      (gdb) bt
      		 
      #0  0x000055a26671562b in ha_innobase::reset (this=0x14eab8022a10) at /test/10.9_dbg/storage/innobase/handler/ha_innodb.cc:15735
      		 
      #1  0x000055a266384c80 in handler::ha_reset (this=0x14eab8022a10) at /test/10.9_dbg/sql/handler.cc:7118
      		 
      #2  0x000055a2662ccff2 in THD::mark_tmp_table_as_free_for_reuse (this=this@entry=0x14eab8000db8, table=0x14eab801fbe8) at /test/10.9_dbg/sql/temporary_tables.cc:791
      		 
      #3  0x000055a2662cec57 in THD::mark_tmp_tables_as_free_for_reuse (this=this@entry=0x14eab8000db8) at /test/10.9_dbg/sql/temporary_tables.cc:753
      		 
      #4  0x000055a265fcdf08 in close_thread_tables (thd=thd@entry=0x14eab8000db8) at /test/10.9_dbg/sql/sql_base.cc:865
      		 
      #5  0x000055a26607327a in mysql_execute_command (thd=thd@entry=0x14eab8000db8, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/10.9_dbg/sql/sql_parse.cc:6054
      		 
      #6  0x000055a266059343 in mysql_parse (thd=thd@entry=0x14eab8000db8, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14eb200ee400) at /test/10.9_dbg/sql/sql_parse.cc:8027
      		 
      #7  0x000055a266067fdf in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14eab8000db8, packet=packet@entry=0x14eab800b889 "TRUNCATE t", packet_length=packet_length@entry=10, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_class.h:1362
      		 
      #8  0x000055a26606b426 in do_command (thd=0x14eab8000db8, blocking=blocking@entry=true) at /test/10.9_dbg/sql/sql_parse.cc:1402
      		 
      #9  0x000055a2661e6036 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55a26a1d5098, put_in_cache=put_in_cache@entry=true) at /test/10.9_dbg/sql/sql_connect.cc:1418
      		 
      #10 0x000055a2661e663b in handle_one_connection (arg=arg@entry=0x55a26a1d5098) at /test/10.9_dbg/sql/sql_connect.cc:1312
      		 
      #11 0x000055a26666cd23 in pfs_spawn_thread (arg=0x55a26a117768) at /test/10.9_dbg/storage/perfschema/pfs.cc:2201
      		 
      #12 0x000014eb2a062609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      		 
      #13 0x000014eb29c50293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

      Bug confirmed present in:
      MariaDB: 10.6.8 (dbg), 10.6.8 (opt), 10.7.4 (dbg), 10.7.4 (opt), 10.8.3 (dbg), 10.8.3 (opt), 10.9.0 (dbg), 10.9.0 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.44 (dbg), 10.2.44 (opt), 10.3.35 (dbg), 10.3.35 (opt), 10.4.25 (dbg), 10.4.25 (opt), 10.5.16 (dbg), 10.5.16 (opt)
      MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.37 (dbg), 5.7.37 (opt), 8.0.28 (dbg), 8.0.28 (opt)

      Attachments

        Issue Links

          is caused by

          Bug - A problem which impairs or prevents the functions of the product. MDEV-25506 Atomic DDL: .frm file is removed and orphan InnoDB tablespace is left behind upon crash recovery

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            marko Marko Mäkelä added a comment -

            This was caused by the last part of MDEV-25506. The SIGSEGV occurs because a null pointer ha_innobase::m_prebuilt is being dereferenced. It was set to nullptr in ha_innobase::truncate():

            	if (ib_table->is_temporary()) {
            		 
            		info.options|= HA_LEX_CREATE_TMP_TABLE;
            		 
            		btr_drop_temporary_table(*ib_table);
            		 
            		m_prebuilt->table = nullptr;
            		 
            		row_prebuilt_free(m_prebuilt);
            		 
            		m_prebuilt = nullptr;

            Side note: InnoDB temporary tables should be indifferent to any form of compression.

            marko Marko Mäkelä added a comment - This was caused by the last part of MDEV-25506 . The SIGSEGV occurs because a null pointer ha_innobase::m_prebuilt is being dereferenced. It was set to nullptr in ha_innobase::truncate() : if (ib_table->is_temporary()) { info.options|= HA_LEX_CREATE_TMP_TABLE; btr_drop_temporary_table(*ib_table); m_prebuilt->table = nullptr; row_prebuilt_free(m_prebuilt); m_prebuilt = nullptr; Side note: InnoDB temporary tables should be indifferent to any form of compression.
            marko Marko Mäkelä added a comment -

            When a temporary table cannot be created during TRUNCATE, the error handling does not really work. I added a debug assertion to catch this error earlier. To prevent the error from occurring, I changed create_table_info_t::innobase_table_flags() code so that the page_compressed attribute will be ignored on temporary tables. It is still an error to create any type of ROW_FORMAT=REDUNDANT table with page_compressed.

            marko Marko Mäkelä added a comment - When a temporary table cannot be created during TRUNCATE , the error handling does not really work. I added a debug assertion to catch this error earlier. To prevent the error from occurring, I changed create_table_info_t::innobase_table_flags() code so that the page_compressed attribute will be ignored on temporary tables. It is still an error to create any type of ROW_FORMAT=REDUNDANT table with page_compressed .
            Roel Roel Van de Paar added a comment -

            Thank you for the quick turnaround and fix marko!

            Roel Roel Van de Paar added a comment - Thank you for the quick turnaround and fix marko !

            People

              marko Marko Mäkelä
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.