Core was generated by `/test/mtest/MD140224-mariadb-11.3.2-linux-x86_64-dbg/bin/mariadbd --no-defaults'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
[Current thread is 1 (Thread 0x14fa393f0700 (LWP 2036753))]
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x000014fa5d36d859 in __GI_abort () at abort.c:79
#2 0x000014fa5d36d729 in __assert_fail_base (fmt=0x14fa5d503588 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x55974828d157 "!space.id || m_made_dirty", file=0x55974828ecd0 "/test/mtest/server_dbg/storage/innobase/mtr/mtr0mtr.cc", line=529, function=<optimized out>) at assert.c:92
#3 0x000014fa5d37efd6 in __GI___assert_fail (assertion=assertion@entry=0x55974828d157 "!space.id || m_made_dirty", file=file@entry=0x55974828ecd0 "/test/mtest/server_dbg/storage/innobase/mtr/mtr0mtr.cc", line=line@entry=529, function=function@entry=0x55974828dd60 "void mtr_t::commit_shrink(fil_space_t&, uint32_t)") at assert.c:101
#4 0x0000559747ac70e5 in mtr_t::commit_shrink (this=this@entry=0x14fa393ef790, space=Python Exception <class 'AttributeError'> 'NoneType' object has no attribute 'pointer':
}}, <No data fields>}, freed_ranges = {ranges = std::set with 0 elements}, last_freed_lsn = 0, create_lsn = 62465, flags = 21}, size=size@entry=640) at /test/mtest/server_dbg/storage/innobase/mtr/mtr0mtr.cc:529
#5 0x0000559747c02538 in trx_purge_truncate_history () at /test/mtest/server_dbg/storage/innobase/trx/trx0purge.cc:817
#6 0x0000559747bee5b3 in purge_coordinator_state::do_purge (this=0x559749340210 <purge_state>) at /test/mtest/server_dbg/storage/innobase/srv/srv0srv.cc:1414
#7 purge_coordinator_callback () at /test/mtest/server_dbg/storage/innobase/srv/srv0srv.cc:1496
#8 0x0000559747dd3ed5 in tpool::task_group::execute (this=0x5597493400a0 <purge_coordinator_task_group>, t=t@entry=0x559749340000 <purge_coordinator_task>) at /test/mtest/server_dbg/tpool/task_group.cc:70
#9 0x0000559747dd3f5d in tpool::task::execute (this=0x559749340000 <purge_coordinator_task>) at /test/mtest/server_dbg/tpool/task.cc:32
#10 0x0000559747dd181b in tpool::thread_pool_generic::worker_main (this=0x559749fbf850, thread_var=0x559749fbfe10) at /test/mtest/server_dbg/tpool/tpool_generic.cc:583
#11 0x0000559747dd2fa2 in std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__t=<optimized out>, __f=<optimized out>) at /usr/include/c++/9/bits/invoke.h:89
#12 std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__fn=<optimized out>) at /usr/include/c++/9/bits/invoke.h:95
I can reproduce this on a 32-bit build of MariaDB Server 10.6 or any build of MariaDB Server 10.11 or later. I could not reproduce this on a 32-bit build of MariaDB Server 10.5. For releases earlier than 11.0 (and MDEV-29986), we must also set innodb_undo_tablespaces to at least 2 in order for this code to be executed. The fix is simple:
if (fil_space_t *s= undo_truncate_try(srv_undo_space_id_start + i, size))
The problem is that when innodb_max_undo_log_size=innodb_page_size*2³², the size would evaluate to 0, which would be less than the minimum value 10 MiB (640 pages when using the default innodb_page_size=16k).
Starting with 10.11, also 64-bit builds are affected by this bug, because the variable size would be declared as uint32_t due to the clean-up MDEV-26195.
Marko Mäkelä
added a comment - I can reproduce this on a 32-bit build of MariaDB Server 10.6 or any build of MariaDB Server 10.11 or later. I could not reproduce this on a 32-bit build of MariaDB Server 10.5. For releases earlier than 11.0 (and MDEV-29986 ), we must also set innodb_undo_tablespaces to at least 2 in order for this code to be executed. The fix is simple:
diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.cc
index f3c0adfef24..d142384e266 100644
--- a/storage/innobase/trx/trx0purge.cc
+++ b/storage/innobase/trx/trx0purge.cc
@@ -669,7 +669,9 @@ fil_space_t *purge_sys_t::truncating_tablespace()
if (space || srv_undo_tablespaces_active < 2 || !srv_undo_log_truncate)
return space;
- const ulint size= ulint(srv_max_undo_log_size >> srv_page_size_shift);
+ const uint32_t size=
+ uint32_t(std::min((1ULL << 32) - 1,
+ srv_max_undo_log_size >> srv_page_size_shift));
for (ulint i= truncate_undo_space.last, j= i;; )
{
if (fil_space_t *s= undo_truncate_try(srv_undo_space_id_start + i, size))
The problem is that when innodb_max_undo_log_size=innodb_page_size *2³², the size would evaluate to 0, which would be less than the minimum value 10 MiB (640 pages when using the default innodb_page_size=16k ).
Starting with 10.11, also 64-bit builds are affected by this bug, because the variable size would be declared as uint32_t due to the clean-up MDEV-26195 .
Bug
Critical
I can reproduce this on a 32-bit build of MariaDB Server 10.6 or any build of MariaDB Server 10.11 or later. I could not reproduce this on a 32-bit build of MariaDB Server 10.5. For releases earlier than 11.0 (and
MDEV-29986), we must also set innodb_undo_tablespaces to at least 2 in order for this code to be executed. The fix is simple:diff --git a/storage/innobase/trx/trx0purge.cc b/storage/innobase/trx/trx0purge.ccindex f3c0adfef24..d142384e266 100644--- a/storage/innobase/trx/trx0purge.cc+++ b/storage/innobase/trx/trx0purge.cc@@ -669,7 +669,9 @@ fil_space_t *purge_sys_t::truncating_tablespace()if (space || srv_undo_tablespaces_active < 2 || !srv_undo_log_truncate)return space;- const ulint size= ulint(srv_max_undo_log_size >> srv_page_size_shift);+ const uint32_t size=+ uint32_t(std::min((1ULL << 32) - 1,+ srv_max_undo_log_size >> srv_page_size_shift));for (ulint i= truncate_undo_space.last, j= i;; ){The problem is that when innodb_max_undo_log_size=innodb_page_size*2³², the size would evaluate to 0, which would be less than the minimum value 10 MiB (640 pages when using the default innodb_page_size=16k).
Starting with 10.11, also 64-bit builds are affected by this bug, because the variable size would be declared as uint32_t due to the clean-up
MDEV-26195.