Details
-
Bug
-
Status: Closed (View Workflow)
-
Critical
-
Resolution: Fixed
-
10.5, 10.6, 10.11, 11.1(EOL), 11.2(EOL), 11.3(EOL), 11.4, 11.5(EOL)
Description
--source include/have_innodb.inc
|
--source include/have_partition.inc
|
SET SESSION sql_mode=''; |
CREATE TABLE t (a DATE,b INT,c INT,d INT,e INT,f INT,g INT,h INT,i DATE,j INT,k INT,l INT,m INT,n INT,o INT,p INT,q DATE,r INT,s INT,t INT,u INT,v INT,w INT,x INT,y DATE,z INT,aa INT,ab INT,ac INT,ad INT,ae INT,af INT,PRIMARY KEY(a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v,w,x,y,z,aa,ab,ac,ad,ae,af)) ENGINE=InnoDB PARTITION BY KEY(a) (PARTITION p, PARTITION p2); |
INSERT INTO t (a) VALUES (0); |
SELECT SLEEP(2); # Allow server to finish slow-crashing |
Leads to:
|
11.5.0 3f9182126c64bcec359bebe9ebad2a0e559b13e2 (Debug) |
mariadbd: /test/11.5_dbg/storage/innobase/row/row0purge.cc:617: void row_purge_reset_trx_id(purge_node_t*, mtr_t*): Assertion `heap == __null' failed.
|
|
11.5.0 3f9182126c64bcec359bebe9ebad2a0e559b13e2 (Debug) |
Core was generated by `/test/MD240424-mariadb-11.5.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
|
44 ./nptl/pthread_kill.c: Inappropriate ioctl for device.
|
[Current thread is 1 (LWP 2279836)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
|
#3 0x0000154e8c43c406 in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
|
#4 0x0000154e8c42287c in __GI_abort () at ./stdlib/abort.c:79
|
#5 0x0000154e8c42279b in __assert_fail_base (fmt=0x154e8c5b9f68 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55570b03d943 "heap == __null", file=file@entry=0x55570b023de0 "/test/11.5_dbg/storage/innobase/row/row0purge.cc", line=line@entry=617, function=function@entry=0x55570b023f98 "void row_purge_reset_trx_id(purge_node_t*, mtr_t*)") at ./assert/assert.c:92
|
#6 0x0000154e8c433b86 in __assert_fail (assertion=0x55570b03d943 "heap == __null", file=0x55570b023de0 "/test/11.5_dbg/storage/innobase/row/row0purge.cc", line=617, function=0x55570b023f98 "void row_purge_reset_trx_id(purge_node_t*, mtr_t*)") at ./assert/assert.c:101
|
#7 0x000055570a95ee93 in row_purge_reset_trx_id (node=node@entry=0x55570d656d50, mtr=mtr@entry=0x154e53ffe510)at /test/11.5_dbg/storage/innobase/row/row0purge.cc:617
|
#8 0x000055570a961d01 in row_purge_record_func (node=node@entry=0x55570d656d50, undo_rec=undo_rec@entry=0x154e8262c110 "\001\263\v", thr=thr@entry=0x55570d656cb0, updated_extern=<optimized out>)at /test/11.5_dbg/storage/innobase/row/row0purge.cc:1094
|
#9 0x000055570a963502 in row_purge (thr=<optimized out>, undo_rec=<optimized out>, node=<optimized out>)at /test/11.5_dbg/storage/innobase/row/row0purge.cc:1138
|
#10 row_purge_step (thr=thr@entry=0x55570d656cb0)at /test/11.5_dbg/storage/innobase/row/row0purge.cc:1201
|
#11 0x000055570a8e10f1 in que_thr_step (thr=0x55570d656cb0)at /test/11.5_dbg/storage/innobase/que/que0que.cc:588
|
#12 que_run_threads_low (thr=0x55570d656cb0)at /test/11.5_dbg/storage/innobase/que/que0que.cc:644
|
#13 que_run_threads (thr=0x55570d656cb0)at /test/11.5_dbg/storage/innobase/que/que0que.cc:664
|
#14 0x000055570a9b94b8 in trx_purge (n_tasks=n_tasks@entry=4, history_size=<optimized out>)at /test/11.5_dbg/storage/innobase/trx/trx0purge.cc:1484
|
#15 0x000055570a9a70b1 in purge_coordinator_state::do_purge (this=this@entry=0x55570c0c46e0 <purge_state>)at /test/11.5_dbg/storage/innobase/srv/srv0srv.cc:1425
|
#16 0x000055570a9a5ae7 in purge_coordinator_callback ()at /test/11.5_dbg/storage/innobase/srv/srv0srv.cc:1503
|
#17 0x000055570ab54179 in tpool::task_group::execute (this=0x55570c0c4540 <purge_coordinator_task_group>, t=t@entry=0x55570c0c44a0 <purge_coordinator_task>)at /test/11.5_dbg/tpool/task_group.cc:73
|
#18 0x000055570ab543c9 in tpool::task::execute (this=0x55570c0c44a0 <purge_coordinator_task>)at /test/11.5_dbg/tpool/task.cc:32
|
#19 0x000055570ab52171 in tpool::thread_pool_generic::worker_main (this=0x55570d390ec0, thread_var=0x55570d391380)at /test/11.5_dbg/tpool/tpool_generic.cc:583
|
#20 0x000055570ab53476 in std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*>(__t=<optimized out>, __f=<optimized out>)at /usr/include/c++/12/bits/invoke.h:74
|
#21 std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__fn=<optimized out>)at /usr/include/c++/12/bits/invoke.h:96
|
#22 std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::_M_invoke<0ul, 1ul, 2ul> (this=<optimized out>)at /usr/include/c++/12/bits/std_thread.h:279
|
#23 std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::operator()(this=<optimized out>) at /usr/include/c++/12/bits/std_thread.h:286
|
#24 std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> > >::_M_run (this=<optimized out>)at /usr/include/c++/12/bits/std_thread.h:231
|
#25 0x0000154e8c8e63e3 in std::execute_native_thread_routine (__p=0x154e60000eb0)at ../../../../../src/libstdc++-v3/src/c++11/thread.cc:104
|
#26 0x0000154e8c48f18a in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:444
|
#27 0x0000154e8c51dbd0 in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
|
Bug confirmed present in:
MariaDB: 10.5.25 (dbg), 10.6.18 (dbg), 10.11.8 (dbg), 11.1.5 (dbg), 11.2.4 (dbg), 11.3.3 (dbg), 11.4.2 (dbg), 11.5.0 (dbg)
Bug (or feature/syntax) confirmed not present in:
MariaDB: 10.5.25 (opt), 10.6.18 (opt), 10.11.8 (opt), 11.1.5 (opt), 11.2.4 (opt), 11.3.3 (opt), 11.4.2 (opt), 11.5.0 (opt)
MySQL: 5.5.62 (dbg), 5.5.62 (opt), 5.6.51 (dbg), 5.6.51 (opt), 5.7.44 (dbg), 5.7.44 (opt), 8.0.36 (dbg), 8.0.36 (opt)
Attachments
Activity
Here is a better parameterized test case:
--source include/have_innodb.inc
|
--source include/have_sequence.inc
|
DELIMITER $$;
|
BEGIN NOT ATOMIC |
DECLARE c TEXT DEFAULT(SELECT CONCAT('CREATE TABLE t1(c', |
GROUP_CONCAT(seq SEPARATOR
|
' INT DEFAULT 0, c'), |
' INT DEFAULT 0, PRIMARY KEY(c', |
GROUP_CONCAT(seq SEPARATOR ', c'), |
')) ENGINE=InnoDB;') FROM seq_1_to_32); |
EXECUTE IMMEDIATE c; |
END; |
$$
|
DELIMITER ;$$
|
INSERT INTO t1() VALUES(); |
SET GLOBAL innodb_max_purge_lag_wait=0; |
DROP TABLE t1; |
If I change the 32 to 33, the test will fail with an error:
' failed: ER_TOO_MANY_KEY_PARTS (1070): Too many key parts specified; max 32 parts allowed
|
If I change the 32 to 31, the assertion failure will be avoided. The fix is simple:
diff --git a/storage/innobase/row/row0purge.cc b/storage/innobase/row/row0purge.cc
|
index 629f4177552..9cce724a7eb 100644
|
--- a/storage/innobase/row/row0purge.cc
|
+++ b/storage/innobase/row/row0purge.cc
|
@@ -1062,12 +1062,12 @@ static void row_purge_reset_trx_id(purge_node_t* node, mtr_t* mtr)
|
mem_heap_t* heap = NULL;
|
/* Reserve enough offsets for the PRIMARY KEY and 2 columns
|
so that we can access DB_TRX_ID, DB_ROLL_PTR. */
|
- rec_offs offsets_[REC_OFFS_HEADER_SIZE + MAX_REF_PARTS + 2];
|
+ rec_offs offsets_[REC_OFFS_HEADER_SIZE + MAX_REF_PARTS + 3];
|
rec_offs_init(offsets_);
|
rec_offs* offsets = rec_get_offsets(
|
rec, index, offsets_, index->n_core_fields,
|
trx_id_pos + 2, &heap);
|
- ut_ad(heap == NULL);
|
+ ut_a(heap == NULL);
|
|
ut_ad(dict_index_get_nth_field(index, trx_id_pos)
|
->col->mtype == DATA_SYS); |
Because I only had a non-debug build readily available, I changed the debug assertion as well.
The intention here is that the offsets_ will be large enough for storing offsets. There was an off-by-one error in the condition.
LSAN observes a memory leak in mem_heap_create_block_func (in optimized builds, whereas the assert is in debug builds):
11.3.3 2d9f91a9c8692b2532ee2f475ae10a1b66009f73 (Optimized, UBASAN)
==2401185==ERROR: LeakSanitizer: detected memory leaksIndirect leak of 472 byte(s) in 1 object(s) allocated from:#0 0x55ae147659af in malloc (/test/UBASAN_MD250424-mariadb-11.3.3-linux-x86_64-opt/bin/mariadbd+0x7f3e9af)#1 0x55ae1801b6c2 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, unsigned long) /test/11.3_opt_san/storage/innobase/mem/mem0mem.cc:277#2 0x55ae1801bdc1 in mem_heap_add_block(mem_block_info_t*, unsigned long) /test/11.3_opt_san/storage/innobase/mem/mem0mem.cc:378#3 0x55ae1819e195 in mem_heap_alloc /test/11.3_opt_san/storage/innobase/include/mem0mem.inl:193#4 0x55ae1819e195 in rec_get_offsets_func(unsigned char const*, dict_index_t const*, unsigned short*, unsigned long, unsigned long, mem_block_info_t**) /test/11.3_opt_san/storage/innobase/rem/rem0rec.cc:913#5 0x55ae182de424 in row_purge_reset_trx_id /test/11.3_opt_san/storage/innobase/row/row0purge.cc:614#6 0x55ae182ef63d in row_purge_record_func /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1094#7 0x55ae182f3f1b in row_purge /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1138#8 0x55ae182f3f1b in row_purge_step(que_thr_t*) /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1201#9 0x55ae1817ccea in que_thr_step /test/11.3_opt_san/storage/innobase/que/que0que.cc:588#10 0x55ae1817ccea in que_run_threads_low /test/11.3_opt_san/storage/innobase/que/que0que.cc:644#11 0x55ae1817ccea in que_run_threads(que_thr_t*) /test/11.3_opt_san/storage/innobase/que/que0que.cc:664#12 0x55ae146675f0 in trx_purge(unsigned long, unsigned long) /test/11.3_opt_san/storage/innobase/trx/trx0purge.cc:1484#13 0x55ae183d2711 in purge_coordinator_state::do_purge() /test/11.3_opt_san/storage/innobase/srv/srv0srv.cc:1418#14 0x55ae183d2711 in purge_coordinator_callback /test/11.3_opt_san/storage/innobase/srv/srv0srv.cc:1496#15 0x55ae18afffa1 in tpool::task_group::execute(tpool::task*) /test/11.3_opt_san/tpool/task_group.cc:70#16 0x55ae18aefcd8 in tpool::thread_pool_generic::worker_main(tpool::worker_data*) /test/11.3_opt_san/tpool/tpool_generic.cc:583#17 0x14dca72e63e2 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xe63e2)Indirect leak of 184 byte(s) in 1 object(s) allocated from:#0 0x55ae147659af in malloc (/test/UBASAN_MD250424-mariadb-11.3.3-linux-x86_64-opt/bin/mariadbd+0x7f3e9af)#1 0x55ae1801b6c2 in mem_heap_create_block_func(mem_block_info_t*, unsigned long, unsigned long) /test/11.3_opt_san/storage/innobase/mem/mem0mem.cc:277#2 0x55ae181a042c in mem_heap_create_func /test/11.3_opt_san/storage/innobase/include/mem0mem.inl:377#3 0x55ae181a042c in rec_get_offsets_func(unsigned char const*, dict_index_t const*, unsigned short*, unsigned long, unsigned long, mem_block_info_t**) /test/11.3_opt_san/storage/innobase/rem/rem0rec.cc:909#4 0x55ae182de424 in row_purge_reset_trx_id /test/11.3_opt_san/storage/innobase/row/row0purge.cc:614#5 0x55ae182ef63d in row_purge_record_func /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1094#6 0x55ae182f3f1b in row_purge /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1138#7 0x55ae182f3f1b in row_purge_step(que_thr_t*) /test/11.3_opt_san/storage/innobase/row/row0purge.cc:1201#8 0x55ae1817ccea in que_thr_step /test/11.3_opt_san/storage/innobase/que/que0que.cc:588#9 0x55ae1817ccea in que_run_threads_low /test/11.3_opt_san/storage/innobase/que/que0que.cc:644#10 0x55ae1817ccea in que_run_threads(que_thr_t*) /test/11.3_opt_san/storage/innobase/que/que0que.cc:664#11 0x55ae146675f0 in trx_purge(unsigned long, unsigned long) /test/11.3_opt_san/storage/innobase/trx/trx0purge.cc:1484#12 0x55ae183d2711 in purge_coordinator_state::do_purge() /test/11.3_opt_san/storage/innobase/srv/srv0srv.cc:1418#13 0x55ae183d2711 in purge_coordinator_callback /test/11.3_opt_san/storage/innobase/srv/srv0srv.cc:1496#14 0x55ae18afffa1 in tpool::task_group::execute(tpool::task*) /test/11.3_opt_san/tpool/task_group.cc:70#15 0x55ae18aefcd8 in tpool::thread_pool_generic::worker_main(tpool::worker_data*) /test/11.3_opt_san/tpool/tpool_generic.cc:583#16 0x14dca72e63e2 (/lib/x86_64-linux-gnu/libstdc++.so.6+0xe63e2)SUMMARY: AddressSanitizer: 656 byte(s) leaked in 2 allocation(s).240504 15:12:29 [ERROR] mysqld got signal 6 ;