Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32221

SIGSEGV in ha_innobase::update_row, UBSAN: member access within null pointer of type 'struct TABLE_LIST'

    XMLWordPrintable

Details

    Description

      set global event_scheduler=1;
      ALTER TABLE mysql.event ENGINE=InnoDB;
      CREATE EVENT e_x2 ON SCHEDULE EVERY 1 SECOND DO DROP TABLE x_t;
      

      Leads to:

      11.3.0 8ad1e26b1bafa4ed9928306efc10c047f2274108 (Optimized)

      Core was generated by `/test/MD080923-mariadb-11.3.0-linux-x86_64-opt/bin/mariadbd --no-defaults --cor'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  ha_innobase::update_row (this=0x14f5e802a110, 
          old_row=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., 
          new_row=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...)
          at /test/11.3_opt/sql/sql_trigger.h:43
      [Current thread is 1 (Thread 0x14f62c0de700 (LWP 1554761))]
      (gdb) bt
      #0  ha_innobase::update_row (this=0x14f5e802a110, old_row=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_row=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/11.3_opt/sql/sql_trigger.h:43
      #1  0x0000555bbe85115e in handler::ha_update_row (this=0x14f5e802a110, old_data=0x14f5e8033770 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_data=0x14f5e8032e40 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/11.3_opt/sql/handler.cc:7891
      #2  0x0000555bbe9b6a48 in Event_db_repository::update_timing_fields_for_event (this=<optimized out>, thd=thd@entry=0x14f5e8018db8, event_db_name=0x14f5dc000c40, event_name=0x14f5dc000c50, last_executed=last_executed@entry=1695286210, status=status@entry=1) at /test/11.3_opt/sql/event_db_repository.cc:1159
      #3  0x0000555bbe9b490e in Event_queue::get_top_for_execution_if_time (this=0x555bc100e4d0, thd=thd@entry=0x14f5e8018db8, event_name=event_name@entry=0x14f62c0ddd48) at /test/11.3_opt/sql/event_queue.cc:696
      #4  0x0000555bbe9b37df in Event_scheduler::run (this=this@entry=0x555bc125adc0, thd=0x14f5e8018db8) at /test/11.3_opt/sql/event_scheduler.cc:492
      #5  0x0000555bbe9b38fc in event_scheduler_thread (arg=0x14f5e8017628) at /test/11.3_opt/sql/event_scheduler.cc:236
      #6  0x000014f659002609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #7  0x000014f658bee133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.4.32 e937a64d462c83e379b8cf26b7765df0e22ae358 (Optimized)

      Core was generated by `/test/MD080923-mariadb-10.4.32-linux-x86_64-opt/bin/mariadbd --no-defaults --co'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  calc_row_difference (uvect=<optimized out>, old_row=<optimized out>, 
          new_row=<optimized out>, table=0x1488ec022038, upd_buff=<optimized out>, 
          buff_len=<optimized out>, prebuilt=<optimized out>, 
          auto_inc=<optimized out>) at /test/10.4_opt/sql/sql_trigger.h:42
      [Current thread is 1 (Thread 0x14890b8b2700 (LWP 1315776))]
      (gdb) bt
      #0  calc_row_difference (uvect=<optimized out>, old_row=<optimized out>, new_row=<optimized out>, table=0x1488ec022038, upd_buff=<optimized out>, buff_len=<optimized out>, prebuilt=<optimized out>, auto_inc=<optimized out>) at /test/10.4_opt/sql/sql_trigger.h:42
      #1  0x000055d252767664 in ha_innobase::update_row (this=0x1488ec032380, old_row=0x1488ec0330a8 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_row=0x1488ec032b10 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/10.4_opt/storage/innobase/handler/ha_innodb.cc:8932
      #2  0x000055d2524d7d66 in handler::ha_update_row (this=0x1488ec032380, old_data=0x1488ec0330a8 ")\374test", ' ' <repeats 188 times>, "e_x2  "..., new_data=0x1488ec032b10 "!\374test", ' ' <repeats 188 times>, "e_x2  "...) at /test/10.4_opt/sql/handler.cc:6916
      #3  0x000055d25264ce00 in Event_db_repository::update_timing_fields_for_event (this=<optimized out>, thd=thd@entry=0x1488ec016f38, event_db_name=<optimized out>, event_name=0x1488e0000c50, last_executed=last_executed@entry=1695289600, status=status@entry=1) at /test/10.4_opt/sql/event_db_repository.cc:1154
      #4  0x000055d25264af8e in Event_queue::get_top_for_execution_if_time (this=0x55d254c44b20, thd=thd@entry=0x1488ec016f38, event_name=event_name@entry=0x14890b8b1e08) at /test/10.4_opt/sql/event_queue.cc:690
      #5  0x000055d252649e8f in Event_scheduler::run (this=this@entry=0x55d254c11da0, thd=0x1488ec016f38) at /test/10.4_opt/sql/event_scheduler.cc:478
      #6  0x000055d252649fac in event_scheduler_thread (arg=0x1488ec021ed8) at /test/10.4_opt/sql/event_scheduler.cc:235
      #7  0x000014894a872609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #8  0x000014894a45e133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      10.4.32 e937a64d462c83e379b8cf26b7765df0e22ae358 (Debug)

      mariadbd: /test/10.4_dbg/sql/sql_base.cc:897: void close_thread_tables(THD*): Assertion `thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)' failed.
      

      10.4.32 e937a64d462c83e379b8cf26b7765df0e22ae358 (Debug)

      Core was generated by `/test/MD080923-mariadb-10.4.32-linux-x86_64-dbg/bin/mariadbd --no-defaults --co'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      [Current thread is 1 (Thread 0x14d87ceac700 (LWP 2392110))]
      (gdb) bt
      #0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
      #1  0x000014d897977859 in __GI_abort () at abort.c:79
      #2  0x000014d897977729 in __assert_fail_base (fmt=0x14d897b0d588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55c18e9b1c48 "thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)", file=0x55c18e9b1570 "/test/10.4_dbg/sql/sql_base.cc", line=897, function=<optimized out>) at assert.c:92
      #3  0x000014d897988fd6 in __GI___assert_fail (assertion=assertion@entry=0x55c18e9b1c48 "thd->transaction.stmt.is_empty() || thd->in_sub_stmt || (thd->state_flags & Open_tables_state::BACKUPS_AVAIL)", file=file@entry=0x55c18e9b1570 "/test/10.4_dbg/sql/sql_base.cc", line=line@entry=897, function=function@entry=0x55c18e9b1c28 "void close_thread_tables(THD*)") at assert.c:101
      #4  0x000055c18dd3e683 in close_thread_tables (thd=thd@entry=0x14d838000d28) at /test/10.4_dbg/sql/handler.h:1712
      #5  0x000055c18e228cf8 in Event_db_repository::create_event (this=<optimized out>, thd=thd@entry=0x14d838000d28, parse_data=parse_data@entry=0x14d8380125e8, event_already_exists=event_already_exists@entry=0x14d87cea961f) at /test/10.4_dbg/sql/event_db_repository.cc:748
      #6  0x000055c18dec125d in Events::create_event (thd=thd@entry=0x14d838000d28, parse_data=0x14d8380125e8) at /test/10.4_dbg/sql/events.cc:364
      #7  0x000055c18ddb5f7d in mysql_execute_command (thd=thd@entry=0x14d838000d28) at /test/10.4_dbg/sql/sql_parse.cc:5268
      #8  0x000055c18ddbb262 in mysql_parse (thd=thd@entry=0x14d838000d28, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14d87ceab3b0, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_parse.cc:8012
      #9  0x000055c18ddbdd7d in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14d838000d28, packet=packet@entry=0x14d838019509 "CREATE EVENT e_x2 ON SCHEDULE EVERY 1 SECOND DO DROP TABLE x_t", packet_length=packet_length@entry=62, is_com_multi=is_com_multi@entry=false, is_next_command=is_next_command@entry=false) at /test/10.4_dbg/sql/sql_class.h:1231
      #10 0x000055c18ddc05a7 in do_command (thd=0x14d838000d28) at /test/10.4_dbg/sql/sql_parse.cc:1378
      #11 0x000055c18dedd4e9 in do_handle_one_connection (connect=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1420
      #12 0x000055c18dedd5a5 in handle_one_connection (arg=<optimized out>) at /test/10.4_dbg/sql/sql_connect.cc:1324
      #13 0x000014d897e88609 in start_thread (arg=<optimized out>) at pthread_create.c:477
      #14 0x000014d897a74133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
      

      Bug confirmed present in:
      MariaDB: 10.4.32 (dbg), 10.4.32 (opt), 10.5.23 (dbg), 10.5.23 (opt), 10.6.16 (dbg), 10.6.16 (opt), 10.9.8 (dbg), 10.9.8 (opt), 10.10.7 (opt), 10.10.7 (dbg), 10.11.6 (dbg), 10.11.6 (opt), 11.0.4 (dbg), 11.0.4 (opt), 11.1.3 (dbg), 11.1.3 (opt), 11.2.2 (dbg), 11.2.2 (opt), 11.3.0 (dbg), 11.3.0 (opt)

      Attachments

        Issue Links

          Activity

            People

              nikitamalyavin Nikita Malyavin
              ramesh Ramesh Sivaraman
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.