Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28764

SIGSEGV in spider_db_set_names_internal on INSERT

    XMLWordPrintable

    Details

      Description

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      CREATE TABLE t (c INT) ENGINE=Spider;
      LOCK TABLES t WRITE CONCURRENT;
      SHOW TABLES;
      INSERT INTO t VALUES (2);
      

      Leads to:

      10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Optimized)

      Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000150809bc85cd in spider_db_set_names_internal (trx=0x1507c003c268, 
          share=0x1507c00586e8, conn=conn@entry=0x1507c0060968, all_link_idx=0, 
          need_mon=0x1507c005f308)
          at /test/10.4_opt/storage/spider/spd_db_conn.cc:909
      [Current thread is 1 (Thread 0x150809ccc700 (LWP 3539697))]
      (gdb) bt
      #0  0x0000150809bc85cd in spider_db_set_names_internal (trx=0x1507c003c268, share=0x1507c00586e8, conn=conn@entry=0x1507c0060968, all_link_idx=0, need_mon=0x1507c005f308) at /test/10.4_opt/storage/spider/spd_db_conn.cc:909
      #1  0x0000150809bc8775 in spider_db_set_names (spider=spider@entry=0x1507c0057b10, conn=conn@entry=0x1507c0060968, link_idx=link_idx@entry=0) at /test/10.4_opt/storage/spider/spd_db_conn.cc:955
      #2  0x0000150809bcbab1 in spider_db_bulk_insert (spider=spider@entry=0x1507c0057b10, table=0x1507c0056cf8, copy_info=copy_info@entry=0x1507c0057ef0, bulk_end=bulk_end@entry=false) at /test/10.4_opt/storage/spider/spd_db_conn.cc:6274
      #3  0x0000150809c1010d in ha_spider::write_row (this=0x1507c0057b10, buf=0x1507c00244e8 "\375\002") at /test/10.4_opt/storage/spider/ha_spider.cc:10182
      #4  0x0000558e0f5ebc51 in handler::ha_write_row (this=0x1507c0057b10, buf=0x1507c00244e8 "\375\002") at /test/10.4_opt/sql/handler.cc:6791
      #5  0x0000558e0f3b5fdd in write_record (thd=thd@entry=0x1507c0000c48, table=table@entry=0x1507c0056cf8, info=info@entry=0x150809cc9970) at /test/10.4_opt/sql/sql_insert.cc:2077
      #6  0x0000558e0f3bc826 in mysql_insert (thd=thd@entry=0x1507c0000c48, table_list=<optimized out>, fields=@0x1507c0005700: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005700, elements = 0}, <No data fields>}, values_list=@0x1507c0005748: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1507c0010b50, last = 0x1507c0010b50, elements = 1}, <No data fields>}, update_fields=@0x1507c0005730: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005730, elements = 0}, <No data fields>}, update_values=@0x1507c0005718: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005718, elements = 0}, <No data fields>}, duplic=<optimized out>, ignore=<optimized out>) at /test/10.4_opt/sql/sql_insert.cc:1083
      #7  0x0000558e0f3eab0d in mysql_execute_command (thd=0x1507c0000c48) at /test/10.4_opt/sql/sql_parse.cc:4598
      #8  0x0000558e0f3f11a2 in mysql_parse (thd=0x1507c0000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:7995
      #9  0x0000558e0f3f3b5a in dispatch_command (command=COM_QUERY, thd=0x1507c0000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_class.h:1201
      #10 0x0000558e0f3f56af in do_command (thd=0x1507c0000c48) at /test/10.4_opt/sql/sql_parse.cc:1378
      #11 0x0000558e0f4e0dbe in do_handle_one_connection (connect=0x558e119f2938) at /test/10.4_opt/sql/sql_connect.cc:1420
      #12 0x0000558e0f4e0e4d in handle_one_connection (arg=<optimized out>) at /test/10.4_opt/sql/sql_connect.cc:1316
      #13 0x0000150824c07609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #14 0x00001508247f3133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Debug)

      Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  spider_db_bulk_insert (spider=spider@entry=0x152d48081398, 
          table=0x152d480800b0, copy_info=copy_info@entry=0x152d48081778, 
          bulk_end=bulk_end@entry=false)
          at /test/10.4_dbg/storage/spider/spd_db_conn.cc:6239
      [Current thread is 1 (Thread 0x152da1c38700 (LWP 3562462))]
      (gdb) bt
      #0  spider_db_bulk_insert (spider=spider@entry=0x152d48081398, table=0x152d480800b0, copy_info=copy_info@entry=0x152d48081778, bulk_end=bulk_end@entry=false) at /test/10.4_dbg/storage/spider/spd_db_conn.cc:6239
      #1  0x0000152da1b56b0f in ha_spider::write_row (this=0x152d48081398, buf=0x152d48080f40 "\375\002") at /test/10.4_dbg/storage/spider/ha_spider.cc:10182
      #2  0x000055809d773fec in handler::ha_write_row (this=0x152d48081398, buf=0x152d48080f40 "\375\002") at /test/10.4_dbg/sql/handler.cc:6791
      #3  0x000055809d4a36fa in write_record (thd=thd@entry=0x152d48000d90, table=table@entry=0x152d480800b0, info=info@entry=0x152da1c35b10) at /test/10.4_dbg/sql/sql_insert.cc:2077
      #4  0x000055809d4ad521 in mysql_insert (thd=thd@entry=0x152d48000d90, table_list=<optimized out>, fields=@0x152d48005a08: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a08, elements = 0}, <No data fields>}, values_list=@0x152d48005a50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d48013d98, last = 0x152d48013d98, elements = 1}, <No data fields>}, update_fields=@0x152d48005a38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a38, elements = 0}, <No data fields>}, update_values=@0x152d48005a20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a20, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false) at /test/10.4_dbg/sql/sql_insert.cc:1083
      #5  0x000055809d4e4aa1 in mysql_execute_command (thd=thd@entry=0x152d48000d90) at /test/10.4_dbg/sql/sql_parse.cc:4598
      #6  0x000055809d4ebe43 in mysql_parse (thd=thd@entry=0x152d48000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152da1c37530, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7995
      #7  0x000055809d4ee969 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152d48000d90, packet=packet@entry=0x152d4801a1d1 "INSERT INTO t VALUES (2)", packet_length=packet_length@entry=24, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1201
      #8  0x000055809d4f142a in do_command (thd=0x152d48000d90) at /test/10.4_dbg/sql/sql_parse.cc:1378
      #9  0x000055809d612321 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420
      #10 0x000055809d6123e1 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1316
      #11 0x0000152dbcc0c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #12 0x0000152dbc7f8133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.26 (dbg), 10.4.26 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)

      SIGSEGV|spider_db_set_names_internal|spider_db_set_names|spider_db_bulk_insert|ha_spider::write_row
      SIGSEGV|spider_db_bulk_insert|ha_spider::write_row|handler::ha_write_row|write_record
      

      The debug crash matches MDEV-27231, which seems to be related but different versions and there is no DELAYED in the testcase of this bug.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              nayuta-yanagisawa Nayuta Yanagisawa
              Reporter:
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:

                  Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.