Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28764

SIGSEGV in spider_db_set_names_internal on INSERT

    XMLWordPrintable

Details

    Description

      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      CREATE TABLE t (c INT) ENGINE=Spider;
      LOCK TABLES t WRITE CONCURRENT;
      SHOW TABLES;
      INSERT INTO t VALUES (2);
      

      Leads to:

      10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Optimized)

      Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-opt/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x0000150809bc85cd in spider_db_set_names_internal (trx=0x1507c003c268, 
          share=0x1507c00586e8, conn=conn@entry=0x1507c0060968, all_link_idx=0, 
          need_mon=0x1507c005f308)
          at /test/10.4_opt/storage/spider/spd_db_conn.cc:909
      [Current thread is 1 (Thread 0x150809ccc700 (LWP 3539697))]
      (gdb) bt
      #0  0x0000150809bc85cd in spider_db_set_names_internal (trx=0x1507c003c268, share=0x1507c00586e8, conn=conn@entry=0x1507c0060968, all_link_idx=0, need_mon=0x1507c005f308) at /test/10.4_opt/storage/spider/spd_db_conn.cc:909
      #1  0x0000150809bc8775 in spider_db_set_names (spider=spider@entry=0x1507c0057b10, conn=conn@entry=0x1507c0060968, link_idx=link_idx@entry=0) at /test/10.4_opt/storage/spider/spd_db_conn.cc:955
      #2  0x0000150809bcbab1 in spider_db_bulk_insert (spider=spider@entry=0x1507c0057b10, table=0x1507c0056cf8, copy_info=copy_info@entry=0x1507c0057ef0, bulk_end=bulk_end@entry=false) at /test/10.4_opt/storage/spider/spd_db_conn.cc:6274
      #3  0x0000150809c1010d in ha_spider::write_row (this=0x1507c0057b10, buf=0x1507c00244e8 "\375\002") at /test/10.4_opt/storage/spider/ha_spider.cc:10182
      #4  0x0000558e0f5ebc51 in handler::ha_write_row (this=0x1507c0057b10, buf=0x1507c00244e8 "\375\002") at /test/10.4_opt/sql/handler.cc:6791
      #5  0x0000558e0f3b5fdd in write_record (thd=thd@entry=0x1507c0000c48, table=table@entry=0x1507c0056cf8, info=info@entry=0x150809cc9970) at /test/10.4_opt/sql/sql_insert.cc:2077
      #6  0x0000558e0f3bc826 in mysql_insert (thd=thd@entry=0x1507c0000c48, table_list=<optimized out>, fields=@0x1507c0005700: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005700, elements = 0}, <No data fields>}, values_list=@0x1507c0005748: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x1507c0010b50, last = 0x1507c0010b50, elements = 1}, <No data fields>}, update_fields=@0x1507c0005730: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005730, elements = 0}, <No data fields>}, update_values=@0x1507c0005718: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x558e103f0560 <end_of_list>, last = 0x1507c0005718, elements = 0}, <No data fields>}, duplic=<optimized out>, ignore=<optimized out>) at /test/10.4_opt/sql/sql_insert.cc:1083
      #7  0x0000558e0f3eab0d in mysql_execute_command (thd=0x1507c0000c48) at /test/10.4_opt/sql/sql_parse.cc:4598
      #8  0x0000558e0f3f11a2 in mysql_parse (thd=0x1507c0000c48, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_parse.cc:7995
      #9  0x0000558e0f3f3b5a in dispatch_command (command=COM_QUERY, thd=0x1507c0000c48, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>) at /test/10.4_opt/sql/sql_class.h:1201
      #10 0x0000558e0f3f56af in do_command (thd=0x1507c0000c48) at /test/10.4_opt/sql/sql_parse.cc:1378
      #11 0x0000558e0f4e0dbe in do_handle_one_connection (connect=0x558e119f2938) at /test/10.4_opt/sql/sql_connect.cc:1420
      #12 0x0000558e0f4e0e4d in handle_one_connection (arg=<optimized out>) at /test/10.4_opt/sql/sql_connect.cc:1316
      #13 0x0000150824c07609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #14 0x00001508247f3133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.4.26 ebbd5ef6e2902a51a46e47dbb8a8667593cb25e7 (Debug)

      Core was generated by `/test/MD310522-mariadb-10.4.26-linux-x86_64-dbg/bin/mysqld --no-defaults --core'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  spider_db_bulk_insert (spider=spider@entry=0x152d48081398, 
          table=0x152d480800b0, copy_info=copy_info@entry=0x152d48081778, 
          bulk_end=bulk_end@entry=false)
          at /test/10.4_dbg/storage/spider/spd_db_conn.cc:6239
      [Current thread is 1 (Thread 0x152da1c38700 (LWP 3562462))]
      (gdb) bt
      #0  spider_db_bulk_insert (spider=spider@entry=0x152d48081398, table=0x152d480800b0, copy_info=copy_info@entry=0x152d48081778, bulk_end=bulk_end@entry=false) at /test/10.4_dbg/storage/spider/spd_db_conn.cc:6239
      #1  0x0000152da1b56b0f in ha_spider::write_row (this=0x152d48081398, buf=0x152d48080f40 "\375\002") at /test/10.4_dbg/storage/spider/ha_spider.cc:10182
      #2  0x000055809d773fec in handler::ha_write_row (this=0x152d48081398, buf=0x152d48080f40 "\375\002") at /test/10.4_dbg/sql/handler.cc:6791
      #3  0x000055809d4a36fa in write_record (thd=thd@entry=0x152d48000d90, table=table@entry=0x152d480800b0, info=info@entry=0x152da1c35b10) at /test/10.4_dbg/sql/sql_insert.cc:2077
      #4  0x000055809d4ad521 in mysql_insert (thd=thd@entry=0x152d48000d90, table_list=<optimized out>, fields=@0x152d48005a08: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a08, elements = 0}, <No data fields>}, values_list=@0x152d48005a50: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x152d48013d98, last = 0x152d48013d98, elements = 1}, <No data fields>}, update_fields=@0x152d48005a38: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a38, elements = 0}, <No data fields>}, update_values=@0x152d48005a20: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x55809e97c690 <end_of_list>, last = 0x152d48005a20, elements = 0}, <No data fields>}, duplic=DUP_ERROR, ignore=false) at /test/10.4_dbg/sql/sql_insert.cc:1083
      #5  0x000055809d4e4aa1 in mysql_execute_command (thd=thd@entry=0x152d48000d90) at /test/10.4_dbg/sql/sql_parse.cc:4598
      #6  0x000055809d4ebe43 in mysql_parse (thd=thd@entry=0x152d48000d90, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x152da1c37530, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:7995
      #7  0x000055809d4ee969 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x152d48000d90, packet=packet@entry=0x152d4801a1d1 "INSERT INTO t VALUES (2)", packet_length=packet_length@entry=24, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1201
      #8  0x000055809d4f142a in do_command (thd=0x152d48000d90) at /test/10.4_dbg/sql/sql_parse.cc:1378
      #9  0x000055809d612321 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420
      #10 0x000055809d6123e1 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1316
      #11 0x0000152dbcc0c609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #12 0x0000152dbc7f8133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.26 (dbg), 10.4.26 (opt)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.3.36 (dbg), 10.3.36 (opt), 10.5.17 (dbg), 10.5.17 (opt), 10.6.9 (dbg), 10.6.9 (opt), 10.7.5 (dbg), 10.7.5 (opt), 10.8.4 (dbg), 10.8.4 (opt), 10.9.2 (dbg), 10.9.2 (opt), 10.10.0 (dbg), 10.10.0 (opt)

      SIGSEGV|spider_db_set_names_internal|spider_db_set_names|spider_db_bulk_insert|ha_spider::write_row
      SIGSEGV|spider_db_bulk_insert|ha_spider::write_row|handler::ha_write_row|write_record
      

      The debug crash matches MDEV-27231, which seems to be related but different versions and there is no DELAYED in the testcase of this bug.

      Attachments

        Issue Links

          Activity

            People

              ycp Yuchen Pei
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.