Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-29277

On error, fts_sync_table() fails to release a table handle

Details

    Description

      It looks like there are still several issues around the table->get_ref_count() == 0 assert (ref MDEV-26636, MDEV-29250). Here is a list of UniqueID's/stacks that I have seen in connection with this:

      table->get_ref_count() == 0|SIGABRT|ut_dbg_assertion_failed|dict_sys_t::remove|dict_sys_t::close|innodb_shutdown
      		 
      table->get_ref_count() == 0|SIGABRT|ut_dbg_assertion_failed|dict_sys_t::remove|trx_t::commit|ha_innobase::delete_table
      		 
      table->get_ref_count() == 0|SIGABRT|ut_dbg_assertion_failed|dict_sys_t::remove|trx_t::commit|ha_innobase::create
      		 
      table->get_ref_count() > 0|SIGABRT|ut_dbg_assertion_failed|dict_table_close|row_prebuilt_free|ha_innobase::close
      		 
      table->get_ref_count() == 0|SIGABRT|ut_dbg_assertion_failed|dict_sys_t::remove|row_drop_table_for_mysql|ha_innobase::delete_table

      Issues seem to be highly sporadic, and so far I have several testcases just under 100 lines, some around 150 lines and some 400-900 lines. I will attempt to reduce further to ~10 lines or less.
      Here is a selection of versions I have seen this bug on (list does not correlate to list above). Note the numbers after MD are DDMMYY.

      MD140222-mariadb-10.9.0-linux-x86_64-dbg @ b5852ffbeebc3000982988383daeefb0549e058a
      		 
      MD030322-mariadb-10.9.0-linux-x86_64-dbg 177345dadc9250387343164be0053b1952fc59c1
      		 
      MD160322-mariadb-10.5.16-linux-x86_64-opt @ 73fee39ea62037780c59161507e89dd76c10b7a3
      		 
      MD160322-mariadb-10.8.3-linux-x86_64-dbg @ 9f5a3e568913e0810109554608c56c93f3ec24f8
      		 
      online-alter_MD080622-mariadb-10.10.0-linux-x86_64-dbg @ d7a7d16713070c7c2902c3df4b4f6d024cd0320f
      		 
      MDEV-28883_MD280622-mariadb-10.10.0-linux-x86_64-dbg @ 2db18fdb3d68d906fbd188ec570a64502ba55849
      		 
      MD120722-mariadb-10.10.0-linux-x86_64-dbg @ 88b22356e623fd63aa87273a895521a6e6667bc7

      Likely other versions (and especially 10.6, 10.7 given there is 10.5 and 10.8) are affected.

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-26636 Race conditions due to attempted updates of InnoDB defragmentation statistics for temporary tables

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29053 safe_mutex: Trying to destroy a mutex cache->lock that was locked at innobase/fts/fts0fts.cc on shutdown

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-29250 InnoDB: Failing assertion: table->get_ref_count() == 0

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Ascending order - Click to sort in descending order
            View 4 older comments
            thiru Thirunarayanan Balathandayuthapani added a comment -

            Given test case fails only in 10.6+ versions.

            thiru Thirunarayanan Balathandayuthapani added a comment - Given test case fails only in 10.6+ versions.
            thiru Thirunarayanan Balathandayuthapani added a comment -

            Patch is in bb-10.6-MDEV-29277

            thiru Thirunarayanan Balathandayuthapani added a comment - Patch is in bb-10.6- MDEV-29277
            marko Marko Mäkelä added a comment -

            The fix looks OK to me.

            marko Marko Mäkelä added a comment - The fix looks OK to me.
            marko Marko Mäkelä added a comment - - edited

            This bug is likely not the only reason why the assertion would fail. The provided test case was never claimed to reproduce a crash on 10.5.

            marko Marko Mäkelä added a comment - - edited This bug is likely not the only reason why the assertion would fail. The provided test case was never claimed to reproduce a crash on 10.5.
            marko Marko Mäkelä added a comment -

            I removed the stack-smashing label because I do not see any evidence of any buffer overflow with the posted test case. Buffer overflows like MDEV-23256 can corrupt InnoDB dict_table_t, including dict_table_t::n_ref_count, but no specific evidence of that has been posted in this ticket.

            marko Marko Mäkelä added a comment - I removed the stack-smashing label because I do not see any evidence of any buffer overflow with the posted test case. Buffer overflows like MDEV-23256 can corrupt InnoDB dict_table_t , including dict_table_t::n_ref_count , but no specific evidence of that has been posted in this ticket.

            People

              thiru Thirunarayanan Balathandayuthapani
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.