Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-31264

Purge trying to access freed secondary index page

Details

    Description

      Notes:
      The test case is non-deterministic, run with --repeat=N. It usually fails for me on the first attempt, but it can vary on different machines and builds. Could not however reproduce with rr even in 1000 attempts.
      I don't know what is the role of the failing EXCHANGE PARTITION, but I couldn't remove it. Possibly it can be replaced with something more sensible.

      --source include/have_innodb.inc
      		 
      --source include/have_partition.inc
      		 
       
      		 
      CREATE TABLE t1 (a INT) ENGINE=InnoDB PARTITION BY HASH (a) PARTITIONS 9;
      		 
      INSERT INTO t1 VALUES (6),(6),(1),(6),(1),(3),(2),(3);
      		 
      CREATE TABLE t2 (b INT) ENGINE=InnoDB;
      		 
      CREATE INDEX ind1 ON t1(a);
      		 
      --error ER_NO_SUCH_TABLE
      		 
      ALTER TABLE t1 EXCHANGE PARTITION p6 WITH TABLE non_existing;
      		 
       
      		 
      --connect (con1,localhost,root,,)
      		 
      --send
      		 
        CREATE UNIQUE INDEX ind2 ON t1(a);
      		 
       
      		 
      --connection default
      		 
      CREATE UNIQUE INDEX ind3 ON t2(b);
      		 
      DELETE FROM t1;
      		 
       
      		 
      --connection con1
      		 
      --error 0,ER_DUP_ENTRY
      		 
      --reap
      		 
       
      		 
      sleep 2;
      		 
       
      		 
      # Cleanup
      		 
      DROP TABLE t1, t2;

      10.6 c2710572

      		 
      mariadbd: /data/src/10.6/storage/innobase/buf/buf0buf.cc:2549: buf_block_t* buf_page_get_low(page_id_t, ulint, ulint, buf_block_t*, ulint, mtr_t*, dberr_t*, bool): Assertion `mode == 16 || mode == 12' failed.
      		 
      230514  1:14:45 [ERROR] mysqld got signal 6 ;
      		 
       
      		 
      #9  0x00007f80bf253df2 in __GI___assert_fail (assertion=0x564143a009e0 "mode == 16 || mode == 12", file=0x5641439fd220 "/data/src/10.6/storage/innobase/buf/buf0buf.cc", line=2549, function=0x564143a005e0 "buf_block_t* buf_page_get_low(page_id_t, ulint, ulint, buf_block_t*, ulint, mtr_t*, dberr_t*, bool)") at ./assert/assert.c:101
      		 
      #10 0x00005641425aa99b in buf_page_get_low (page_id=..., zip_size=0, rw_latch=1, guess=0x0, mode=10, mtr=0x7f80b5b41e80, err=0x7f80b5b41210, allow_ibuf_merge=false) at /data/src/10.6/storage/innobase/buf/buf0buf.cc:2549
      		 
      #11 0x00005641425aca80 in buf_page_get_gen (page_id=..., zip_size=0, rw_latch=1, guess=0x0, mode=10, mtr=0x7f80b5b41e80, err=0x7f80b5b41210, allow_ibuf_merge=false) at /data/src/10.6/storage/innobase/buf/buf0buf.cc:2927
      		 
      #12 0x0000564142548331 in btr_cur_t::search_leaf (this=0x7f80b5b419e0, tuple=0x61a000012120, mode=PAGE_CUR_LE, latch_mode=BTR_MODIFY_LEAF, mtr=0x7f80b5b41e80) at /data/src/10.6/storage/innobase/btr/btr0cur.cc:1107
      		 
      #13 0x000056414200e08f in btr_pcur_open (tuple=0x61a000012120, mode=PAGE_CUR_LE, latch_mode=BTR_PURGE_LEAF, cursor=0x7f80b5b419e0, mtr=0x7f80b5b41e80) at /data/src/10.6/storage/innobase/include/btr0pcur.h:431
      		 
      #14 0x00005641423c37ed in row_search_index_entry (entry=0x61a000012120, mode=BTR_PURGE_LEAF, pcur=0x7f80b5b419e0, mtr=0x7f80b5b41e80) at /data/src/10.6/storage/innobase/row/row0row.cc:1281
      		 
      #15 0x00005641423ad393 in row_purge_remove_sec_if_poss_leaf (node=0x61b000002b20, index=0x616000c6f720, entry=0x61a000012120) at /data/src/10.6/storage/innobase/row/row0purge.cc:475
      		 
      #16 0x00005641423add6a in row_purge_remove_sec_if_poss (node=0x61b000002b20, index=0x616000c6f720, entry=0x61a000012120) at /data/src/10.6/storage/innobase/row/row0purge.cc:576
      		 
      #17 0x00005641423ae06e in row_purge_del_mark (node=0x61b000002b20) at /data/src/10.6/storage/innobase/row/row0purge.cc:624
      		 
      #18 0x00005641423b361f in row_purge_record_func (node=0x61b000002b20, undo_rec=0x625000054808 "", thr=0x617000001358, updated_extern=false) at /data/src/10.6/storage/innobase/row/row0purge.cc:1194
      		 
      #19 0x00005641423b3bf3 in row_purge (node=0x61b000002b20, undo_rec=0x625000054808 "", thr=0x617000001358) at /data/src/10.6/storage/innobase/row/row0purge.cc:1255
      		 
      #20 0x00005641423b3ec9 in row_purge_step (thr=0x617000001358) at /data/src/10.6/storage/innobase/row/row0purge.cc:1318
      		 
      #21 0x000056414229a1bf in que_thr_step (thr=0x617000001358) at /data/src/10.6/storage/innobase/que/que0que.cc:588
      		 
      #22 0x000056414229a592 in que_run_threads_low (thr=0x617000001358) at /data/src/10.6/storage/innobase/que/que0que.cc:644
      		 
      #23 0x000056414229a74e in que_run_threads (thr=0x617000001358) at /data/src/10.6/storage/innobase/que/que0que.cc:664
      		 
      #24 0x00005641424392fe in srv_task_execute () at /data/src/10.6/storage/innobase/srv/srv0srv.cc:1595
      		 
      #25 0x0000564142439ec4 in purge_worker_callback () at /data/src/10.6/storage/innobase/srv/srv0srv.cc:1843
      		 
      #26 0x0000564142809439 in tpool::task_group::execute (this=0x5641458de700 <purge_task_group>, t=0x5641458de7c0 <purge_worker_task>) at /data/src/10.6/tpool/task_group.cc:55
      		 
      #27 0x0000564142809c3f in tpool::task::execute (this=0x5641458de7c0 <purge_worker_task>) at /data/src/10.6/tpool/task.cc:32
      		 
      #28 0x00005641427fa9cf in tpool::thread_pool_generic::worker_main (this=0x61900001b380, thread_var=0x630000020400) at /data/src/10.6/tpool/tpool_generic.cc:580
      		 
      #29 0x0000564142808f25 in std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__f=@0x604000000ca8: (void (tpool::thread_pool_generic::*)(tpool::thread_pool_generic * const, tpool::worker_data *)) 0x5641427fa874 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>, __t=@0x604000000ca0: 0x61900001b380) at /usr/include/c++/12/bits/invoke.h:74
      		 
      #30 0x0000564142808d58 in std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__fn=@0x604000000ca8: (void (tpool::thread_pool_generic::*)(tpool::thread_pool_generic * const, tpool::worker_data *)) 0x5641427fa874 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>) at /usr/include/c++/12/bits/invoke.h:96
      		 
      #31 0x0000564142808c8b in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::_M_invoke<0ul, 1ul, 2ul> (this=0x604000000c98) at /usr/include/c++/12/bits/std_thread.h:252
      		 
      #32 0x0000564142808c28 in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::operator() (this=0x604000000c98) at /usr/include/c++/12/bits/std_thread.h:259
      		 
      #33 0x0000564142808c0c in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> > >::_M_run (this=0x604000000c90) at /usr/include/c++/12/bits/std_thread.h:210
      		 
      #34 0x00007f80bf4d44a3 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
      		 
      #35 0x00007f80bf2a7fd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
      		 
      #36 0x00007f80bf3285bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

      The failure apparently started happening (or, if it existed before, it became much more probable) after this commit in 10.6.9 / 10.7.5 / 10.8.4 / 10.9.2:

      commit 0b47c126e31cddda1e94588799599e138400bcf8
      		 
      Author: Marko Mäkelä
      		 
      Date:   Mon Jun 6 14:03:22 2022 +0300
      		 
       
      		 
          MDEV-13542: Crashing on corrupted page is unhelpful

      Attachments

        1. TBR-1510.cfg
          44 kB
        2. TBR-1510.yy
          0.3 kB
        3. TBR-1510.zz
          1 kB

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-31385 Change buffer entries are left behind when freeing a page, causing secondary index corruption when the page is later reused

          • Major - Major loss of function.
          • Closed

          Activity

            People

              thiru Thirunarayanan Balathandayuthapani
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.