Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-28941

SIGABRT in __libc_message + malloc_printerr + double free or corruption (!prev)

    XMLWordPrintable

Details

    Description

      10.[89] optimized build goes to hung mode when executing the given test case.

      SET @@enforce_storage_engine=MEMORY;
      SET sql_mode='';
      CREATE TABLE t1 (c1 INT) ENGINE=InnoDB;
      CREATE TEMPORARY TABLE t4 (c1 INT) ENGINE=InnoDB;
      ALTER TABLE t1 ADD COLUMN c2 VARCHAR(20) NULL DEFAULT USER();
      INSERT DELAYED INTO t1 VALUES (1,"b");
      CREATE TRIGGER i5_t1 BEFORE INSERT ON t1 FOR EACH ROW CALL p4;
      

      Leads to:

      10.7.4 0a1d9d0681fda7595c0d08038357b56cf3bea9eb (Optimized)

      Core was generated by `/test/MD160522-mariadb-10.7.4-linux-x86_64-opt/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x1477fcfa2700 (LWP 3318000))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x0000147815708859 in __GI_abort () at abort.c:79
      #2  0x00001478157733ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x14781589d285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
      #3  0x000014781577b47c in malloc_printerr (str=str@entry=0x14781589f690 "double free or corruption (!prev)") at malloc.c:5347
      #4  0x000014781577d12c in _int_free (av=0x1478158ceb80 <main_arena>, p=0x1477c8002fc0, have_lock=<optimized out>) at malloc.c:4317
      #5  0x000055ab50a99d75 in root_free (root=0x1477c8002550, size=<optimized out>, ptr=<optimized out>) at /test/10.7_opt/mysys/my_alloc.c:78
      #6  free_root (root=root@entry=0x1477c8002550, MyFlags=MyFlags@entry=0) at /test/10.7_opt/mysys/my_alloc.c:501
      #7  0x000055ab504997ee in closefrm (table=table@entry=0x1477c8002298) at /test/10.7_opt/sql/table.cc:4538
      #8  0x000055ab505717c2 in intern_close_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:220
      #9  tc_remove_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:258
      #10 tc_release_table (table=0x1477c8002298) at /test/10.7_opt/sql/table_cache.cc:449
      #11 0x000055ab5034b643 in close_thread_table (thd=thd@entry=0x1477c4000c58, table_ptr=table_ptr@entry=0x1477c4000d48) at /test/10.7_opt/sql/sql_base.cc:991
      #12 0x000055ab5034c87b in close_all_tables_for_name (thd=thd@entry=0x1477c4000c58, share=<optimized out>, extra=extra@entry=HA_EXTRA_NOT_USED, skip_table=skip_table@entry=0x0) at /test/10.7_opt/sql/sql_base.cc:751
      #13 0x000055ab50479e49 in mysql_create_or_drop_trigger (thd=thd@entry=0x1477c4000c58, tables=<optimized out>, create=create@entry=true) at /test/10.7_opt/sql/sql_trigger.cc:714
      #14 0x000055ab503c1a9f in mysql_execute_command (thd=0x1477c4000c58, is_called_from_prepared_stmt=<optimized out>) at /test/10.7_opt/sql/sql_parse.cc:5832
      #15 0x000055ab503b0015 in mysql_parse (rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, thd=0x1477c4000c58) at /test/10.7_opt/sql/sql_parse.cc:8043
      #16 mysql_parse (thd=0x1477c4000c58, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/10.7_opt/sql/sql_parse.cc:7965
      #17 0x000055ab503bbe82 in dispatch_command (command=COM_QUERY, thd=0x1477c4000c58, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /test/10.7_opt/sql/sql_class.h:1360
      #18 0x000055ab503bddd8 in do_command (thd=0x1477c4000c58, blocking=blocking@entry=true) at /test/10.7_opt/sql/sql_parse.cc:1407
      #19 0x000055ab504d226f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55ab531ad2f8, put_in_cache=put_in_cache@entry=true) at /test/10.7_opt/sql/sql_connect.cc:1418
      #20 0x000055ab504d255d in handle_one_connection (arg=0x55ab531ad2f8) at /test/10.7_opt/sql/sql_connect.cc:1312
      #21 0x0000147815c17609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #22 0x0000147815805293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.9.2 6ec17142dcfb1e9d9f41211ed1b6d82e062d1541 (Debug)

      Core was generated by `/test/MD280522-mariadb-10.9.2-linux-x86_64-dbg/bin/mysqld --no-defaults --core-'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x000055ec43f79dfc in Virtual_column_info::cleanup_session_expr (
          this=0x14945c0161d0) at /test/10.9_dbg/sql/table.cc:3658
      [Current thread is 1 (Thread 0x14949c8c5700 (LWP 3275708))]
      (gdb) bt
      #0  0x000055ec43f79dfc in Virtual_column_info::cleanup_session_expr (this=0x14945c0161d0) at /test/10.9_dbg/sql/table.cc:3658
      #1  0x000055ec43f7a199 in TABLE::vcol_cleanup_expr (this=this@entry=0x149460003f48, thd=thd@entry=0x14945c0332e8) at /test/10.9_dbg/sql/table.cc:3752
      #2  0x000055ec43dd9772 in close_thread_table (thd=thd@entry=0x14945c0332e8, table_ptr=table_ptr@entry=0x14945c0333d8) at /test/10.9_dbg/sql/sql_base.cc:968
      #3  0x000055ec43dd9c9e in close_thread_tables (thd=0x14945c0332e8) at /test/10.9_dbg/sql/sql_base.cc:942
      #4  0x000055ec43e22f16 in handle_delayed_insert (arg=0x14945c0332c8) at /test/10.9_dbg/sql/sql_insert.cc:3413
      #5  0x00001494b59d2609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #6  0x00001494b55c0293 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.2.44 (dbg), 10.3.36 (dbg), 10.4.26 (dbg), 10.5.17 (dbg), 10.6.9 (dbg), 10.7.4 (opt), 10.7.5 (dbg), 10.8.3 (opt), 10.8.4 (dbg), 10.9.2 (dbg)

      Bug (or feature/syntax) confirmed not present in:
      MariaDB: 10.2.44 (opt), 10.3.35 (opt), 10.4.25 (opt), 10.5.16 (opt), 10.6.8 (opt)

      Attachments

        Issue Links

          Activity

            People

              midenok Aleksey Midenkov
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.