Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34549

SIGSEGV in my_strcoll_ascii_4bytes_found upon SELECT

Details

    Description

      # mysqld options required for replay: --sql_mode=
      		 
      # non-defined tables are InnoDB
      		 
      INSTALL PLUGIN Spider SONAME 'ha_spider.so';
      		 
      CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE'',USER 'Spider',PASSWORD 'PWD0');
      		 
      CREATE TABLE tSpider (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql", SRV "srv", TABLE "t"';
      		 
      CREATE TABLE t1 (c1 BIGINT AUTO_INCREMENT NULL UNIQUE KEY);
      		 
      CREATE TABLE t5 (c1 INT, c2 CHAR(20)) ENGINE=Spider COMMENT='WRAPPER "mysql", TABLE "t"' COMMENT='WRAPPER "mysql", SRV "srv", TABLE "t"';
      		 
      XA START 'foo';
      		 
      SELECT * FROM information_schema.table_constraints;
      		 
      SELECT * FROM t5;
      		 
      SELECT SLEEP (1);
      		 
      SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC;
      		 
      SELECT SLEEP (1);
      		 
      SELECT * FROM t1 WHERE c1 BETWEEN '0000-00-00' AND '2010-00-01 00:00:00' ORDER BY c1 DESC;
      		 
      SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC;

      Sporadically triggers this crash:

      11.6.0 29e9ade269d803b6823ec57808e0b7fad28baf9e (Optimized)

      		 
      Core was generated by `/test/MD190624-mariadb-11.6.0-linux-x86_64-opt/bin/mariadbd --no-defaults --bas'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x0000559e2839a44f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
          b=<optimized out>, ae=0x15424804aa30 "", a=<optimized out>) at /test/11.6_opt/strings/ctype-ascii.h:111
      		 
      111     /test/11.6_opt/strings/ctype-ascii.h: No such file or directory.                                          
      [Current thread is 1 (LWP 4143818)]
      		 
      (gdb) bt
      		 
      #0  0x0000559e2839a44f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
          b=<optimized out>, ae=0x15424804aa30 "", a=<optimized out>) at /test/11.6_opt/strings/ctype-ascii.h:111
      		 
      #1  my_strnncoll_utf8mb3_bin (cs=<optimized out>, a=<optimized out>, a_length=<optimized out>, 
          b=<optimized out>, b_length=<optimized out>, b_is_prefix=0 '\000') at /test/11.6_opt/strings/strcoll.inl:237
      		 
      #2  0x0000559e28328ed2 in hashcmp (pos=0x1542480b39d8, pos=0x1542480b39d8, length=248, key=0x0, 
          hash=0x15424804caf8) at /test/11.6_opt/mysys/hash.c:381
      		 
      #3  my_hash_first_from_hash_value (hash=0x15424804caf8, hash_value=<optimized out>, key=0x0, length=248, 
          current_record=current_record@entry=0x1542821181ac) at /test/11.6_opt/mysys/hash.c:291
      		 
      #4  0x0000559e28328fa5 in my_hash_search_using_hash_value (hash=<optimized out>, hash_value=<optimized out>, 
          key=<optimized out>, length=<optimized out>) at /test/11.6_opt/mysys/hash.c:245
      		 
      #5  0x00001542820298e9 in spider_conn_queue_and_merge_loop_check (conn=conn@entry=0x15424804c328, 
          lcptr=lcptr@entry=0x154248047548) at /test/11.6_opt/storage/spider/spd_conn.cc:1118
      		 
      #6  0x0000154282029e3d in spider_conn_reset_queue_loop_check (conn=0x15424804c328)
      		 
          at /test/11.6_opt/storage/spider/spd_conn.cc:1239
      		 
      #7  0x000015428202a05f in spider_reset_conn_setted_parameter (conn=<optimized out>, thd=<optimized out>)
      		 
          at /test/11.6_opt/storage/spider/spd_conn.cc:259
      		 
      #8  0x0000154282015966 in spider_db_connect (share=0x15424804df98, conn=conn@entry=0x15424804c328, link_idx=0)
      		 
          at /test/11.6_opt/storage/spider/spd_db_conn.cc:131
      		 
      #9  0x0000154282016620 in spider_db_conn_queue_action (conn=conn@entry=0x15424804c328)
      		 
          at /test/11.6_opt/storage/spider/spd_db_conn.cc:256
      		 
      #10 0x000015428201bb40 in spider_db_before_query (conn=0x15424804c328, need_mon=<optimized out>)
      		 
          at /test/11.6_opt/storage/spider/spd_db_conn.cc:571
      		 
      #11 0x000015428201bd42 in spider_db_set_names_internal (trx=0x154248242f78, share=0x1542480d6178, 
          conn=conn@entry=0x15424804c328, all_link_idx=0, need_mon=0x154248016f38)
      		 
          at /test/11.6_opt/storage/spider/spd_db_conn.cc:799
      		 
      #12 0x000015428201bef9 in spider_db_set_names (spider=<optimized out>, conn=conn@entry=0x15424804c328, 
          link_idx=link_idx@entry=0) at /test/11.6_opt/storage/spider/spd_db_conn.cc:842
      		 
      #13 0x00001542820926d9 in spider_mbase_handler::show_table_status (this=0x15424815bb70, link_idx=0, sts_mode=1, 
          flag=<optimized out>) at /test/11.6_opt/storage/spider/spd_db_mysql.cc:13231
      		 
      #14 0x0000154282045544 in spider_get_sts (share=0x1542480d6178, link_idx=0, tmp_time=tmp_time@entry=1720500481, 
          spider=spider@entry=0x1542480ba760, sts_interval=sts_interval@entry=0, sts_mode=sts_mode@entry=1, 
          sts_sync=sts_sync@entry=0, sts_sync_level=1, flag=82) at /test/11.6_opt/storage/spider/spd_table.cc:7153
      		 
      #15 0x00001542820746a7 in ha_spider::info (this=0x1542480ba760, flag=18)
      		 
          at /test/11.6_opt/storage/spider/ha_spider.cc:6557
      		 
      #16 0x0000559e27bcb291 in make_join_statistics (join=join@entry=0x154248019fd0, tables_list=..., 
          keyuse_array=keyuse_array@entry=0x15424801a328) at /test/11.6_opt/sql/sql_select.cc:5606
      		 
      #17 0x0000559e27bd2242 in JOIN::optimize_inner (this=this@entry=0x154248019fd0)
      		 
          at /test/11.6_opt/sql/sql_select.cc:2679
      		 
      #18 0x0000559e27bd29ea in JOIN::optimize (this=this@entry=0x154248019fd0)
      		 
          at /test/11.6_opt/sql/sql_select.cc:1984
      		 
      #19 0x0000559e27bd2ae1 in mysql_select (thd=thd@entry=0x154248000c68, tables=0x1542480189c8, fields=..., 
          conds=0x154248019298, og_num=1, order=0x154248019e50, group=0x0, having=0x0, proc_param=0x0, 
          select_options=<optimized out>, result=0x154248019fa8, unit=0x154248004f88, select_lex=0x154248017fc8)
      		 
          at /test/11.6_opt/sql/sql_select.cc:5315
      		 
      #20 0x0000559e27bd3334 in handle_select (thd=thd@entry=0x154248000c68, lex=lex@entry=0x154248004ea8, 
          result=result@entry=0x154248019fa8, setup_tables_done_option=setup_tables_done_option@entry=0)
      		 
          at /test/11.6_opt/sql/sql_select.cc:628
      		 
      #21 0x0000559e27b45575 in execute_sqlcom_select (thd=thd@entry=0x154248000c68, all_tables=0x1542480189c8)
      		 
          at /test/11.6_opt/sql/sql_parse.cc:6147
      		 
      #22 0x0000559e27b547ff in mysql_execute_command (thd=thd@entry=0x154248000c68, 
          is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
      		 
          at /test/11.6_opt/sql/sql_parse.cc:3953
      		 
      #23 0x0000559e27b55d16 in mysql_parse (thd=0x154248000c68, rawbuf=<optimized out>, length=<optimized out>, 
          parser_state=<optimized out>) at /test/11.6_opt/sql/sql_parse.cc:7868
      		 
      #24 0x0000559e27b57ef5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154248000c68, 
          packet=packet@entry=0x154248008859 "SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC", 
          packet_length=packet_length@entry=62, blocking=blocking@entry=true) at /test/11.6_opt/sql/sql_parse.cc:1991
      		 
      #25 0x0000559e27b5a4e0 in do_command (thd=0x154248000c68, blocking=blocking@entry=true)
      		 
          at /test/11.6_opt/sql/sql_parse.cc:1405
      		 
      #26 0x0000559e27c89d9f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x559e2bfac6d8, 
          put_in_cache=put_in_cache@entry=true) at /test/11.6_opt/sql/sql_connect.cc:1447
      		 
      #27 0x0000559e27c8a0ed in handle_one_connection (arg=arg@entry=0x559e2bfac6d8)
      		 
          at /test/11.6_opt/sql/sql_connect.cc:1349
      		 
      #28 0x0000559e280435d1 in pfs_spawn_thread (arg=0x559e2bfafb08) at /test/11.6_opt/storage/perfschema/pfs.cc:2201
      		 
      #29 0x00001542a1c97ada in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444
      		 
      #30 0x00001542a1d2847c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      11.5.2 0dfc9ece4843a0931ba17d40ec6483e7b1788aa2 (Optimized)

      		 
      Core was generated by `/test/MD190624-mariadb-11.5.2-linux-x86_64-opt/bin/mariadbd --no-defaults --bas'.
      		 
      Program terminated with signal SIGSEGV, Segmentation fault.
      		 
      #0  0x0000559aade19c2f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
          b=<optimized out>, ae=0x154f040907c0 "", a=<optimized out>) at /test/11.5_opt/strings/ctype-ascii.h:111
      		 
      111     /test/11.5_opt/strings/ctype-ascii.h: No such file or directory.                                          
      [Current thread is 1 (LWP 63373)]
      		 
      (gdb) bt
      		 
      #0  0x0000559aade19c2f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
          b=<optimized out>, ae=0x154f040907c0 "", a=<optimized out>) at /test/11.5_opt/strings/ctype-ascii.h:111
      		 
      #1  my_strnncoll_utf8mb3_bin (cs=<optimized out>, a=<optimized out>, a_length=<optimized out>, 
          b=<optimized out>, b_length=<optimized out>, b_is_prefix=0 '\000') at /test/11.5_opt/strings/strcoll.inl:237
      		 
      #2  0x0000559aadda86b2 in hashcmp (pos=0x154f04099788, pos=0x154f04099788, length=248, key=0x0, 
          hash=0x154f0404c6c8) at /test/11.5_opt/mysys/hash.c:381
      		 
      #3  my_hash_first_from_hash_value (hash=0x154f0404c6c8, hash_value=<optimized out>, key=0x0, length=248, 
          current_record=current_record@entry=0x154f2e0ae1ac) at /test/11.5_opt/mysys/hash.c:291
      		 
      #4  0x0000559aadda8785 in my_hash_search_using_hash_value (hash=<optimized out>, hash_value=<optimized out>, 
          key=<optimized out>, length=<optimized out>) at /test/11.5_opt/mysys/hash.c:245
      		 
      #5  0x0000154f2dfbf8e9 in spider_conn_queue_and_merge_loop_check (conn=conn@entry=0x154f0404bef8, 
          lcptr=lcptr@entry=0x154f04047548) at /test/11.5_opt/storage/spider/spd_conn.cc:1118
      		 
      #6  0x0000154f2dfbfe3d in spider_conn_reset_queue_loop_check (conn=0x154f0404bef8)
      		 
          at /test/11.5_opt/storage/spider/spd_conn.cc:1239
      		 
      #7  0x0000154f2dfc005f in spider_reset_conn_setted_parameter (conn=<optimized out>, thd=<optimized out>)
      		 
          at /test/11.5_opt/storage/spider/spd_conn.cc:259
      		 
      #8  0x0000154f2dfab966 in spider_db_connect (share=0x154f04258038, conn=conn@entry=0x154f0404bef8, link_idx=0)
      		 
          at /test/11.5_opt/storage/spider/spd_db_conn.cc:131
      		 
      #9  0x0000154f2dfac620 in spider_db_conn_queue_action (conn=conn@entry=0x154f0404bef8)
      		 
          at /test/11.5_opt/storage/spider/spd_db_conn.cc:256
      		 
      #10 0x0000154f2dfb1b40 in spider_db_before_query (conn=0x154f0404bef8, need_mon=<optimized out>)
      		 
          at /test/11.5_opt/storage/spider/spd_db_conn.cc:571
      		 
      #11 0x0000154f2dfb1d42 in spider_db_set_names_internal (trx=0x154f04199d98, share=0x154f040d6888, 
          conn=conn@entry=0x154f0404bef8, all_link_idx=0, need_mon=0x154f04016f38)
      		 
          at /test/11.5_opt/storage/spider/spd_db_conn.cc:799
      		 
      #12 0x0000154f2dfb1ef9 in spider_db_set_names (spider=<optimized out>, conn=conn@entry=0x154f0404bef8, 
          link_idx=link_idx@entry=0) at /test/11.5_opt/storage/spider/spd_db_conn.cc:842
      		 
      #13 0x0000154f2e0286d9 in spider_mbase_handler::show_table_status (this=0x154f0406fad0, link_idx=0, sts_mode=1, 
          flag=<optimized out>) at /test/11.5_opt/storage/spider/spd_db_mysql.cc:13231
      		 
      #14 0x0000154f2dfdb544 in spider_get_sts (share=0x154f040d6888, link_idx=0, tmp_time=tmp_time@entry=1720498254, 
          spider=spider@entry=0x154f040d5cd0, sts_interval=sts_interval@entry=0, sts_mode=sts_mode@entry=1, 
          sts_sync=sts_sync@entry=0, sts_sync_level=1, flag=82) at /test/11.5_opt/storage/spider/spd_table.cc:7153
      		 
      #15 0x0000154f2e00a6a7 in ha_spider::info (this=0x154f040d5cd0, flag=18)
      		 
          at /test/11.5_opt/storage/spider/ha_spider.cc:6557
      		 
      #16 0x0000559aad64d081 in make_join_statistics (join=join@entry=0x154f04019fd0, tables_list=..., 
          keyuse_array=keyuse_array@entry=0x154f0401a328) at /test/11.5_opt/sql/sql_select.cc:5606
      		 
      #17 0x0000559aad654032 in JOIN::optimize_inner (this=this@entry=0x154f04019fd0)
      		 
          at /test/11.5_opt/sql/sql_select.cc:2679
      		 
      #18 0x0000559aad6547da in JOIN::optimize (this=this@entry=0x154f04019fd0)
      		 
          at /test/11.5_opt/sql/sql_select.cc:1984
      		 
      #19 0x0000559aad6548d1 in mysql_select (thd=thd@entry=0x154f04000c68, tables=0x154f040189c8, fields=..., 
          conds=0x154f04019298, og_num=1, order=0x154f04019e50, group=0x0, having=0x0, proc_param=0x0, 
          select_options=<optimized out>, result=0x154f04019fa8, unit=0x154f04004f88, select_lex=0x154f04017fc8)
      		 
          at /test/11.5_opt/sql/sql_select.cc:5315
      		 
      #20 0x0000559aad655124 in handle_select (thd=thd@entry=0x154f04000c68, lex=lex@entry=0x154f04004ea8, 
          result=result@entry=0x154f04019fa8, setup_tables_done_option=setup_tables_done_option@entry=0)
      		 
          at /test/11.5_opt/sql/sql_select.cc:628
      		 
      #21 0x0000559aad5c7365 in execute_sqlcom_select (thd=thd@entry=0x154f04000c68, all_tables=0x154f040189c8)
      		 
          at /test/11.5_opt/sql/sql_parse.cc:6147
      		 
      #22 0x0000559aad5d65ef in mysql_execute_command (thd=thd@entry=0x154f04000c68, 
          is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
      		 
          at /test/11.5_opt/sql/sql_parse.cc:3953
      		 
      #23 0x0000559aad5d7b06 in mysql_parse (thd=0x154f04000c68, rawbuf=<optimized out>, length=<optimized out>, 
          parser_state=<optimized out>) at /test/11.5_opt/sql/sql_parse.cc:7868
      		 
      #24 0x0000559aad5d9ce5 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x154f04000c68, 
          packet=packet@entry=0x154f04008859 "SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC", 
          packet_length=packet_length@entry=62, blocking=blocking@entry=true) at /test/11.5_opt/sql/sql_parse.cc:1991
      		 
      #25 0x0000559aad5dc2d0 in do_command (thd=0x154f04000c68, blocking=blocking@entry=true)
      		 
          at /test/11.5_opt/sql/sql_parse.cc:1405
      		 
      #26 0x0000559aad70bb8f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x559ab0ee26b8, 
          put_in_cache=put_in_cache@entry=true) at /test/11.5_opt/sql/sql_connect.cc:1447
      		 
      #27 0x0000559aad70bedd in handle_one_connection (arg=arg@entry=0x559ab0ee26b8)
      		 
          at /test/11.5_opt/sql/sql_connect.cc:1349
      		 
      #28 0x0000559aadac53c1 in pfs_spawn_thread (arg=0x559ab0ee5ae8) at /test/11.5_opt/storage/perfschema/pfs.cc:2201
      		 
      #29 0x0000154f53a97ada in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444
      		 
      #30 0x0000154f53b2847c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

      However, it has thus far been reproducible using reducer only. Potentially system load may be required (30+ mariadbd instances), a theory which may be supported by the SLEEP(1) statements. SLEEP(3) reproduced the issue as well, whereas SLEEP(0.3) did not. Research ongoing. Seen thus far only in 11.6 and 11.5 - 11.1 and 11.4 did not reproduce the issue thus far.
      NTS: /data/KEEP/MDEV-27902/1835

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-34555 SIGSEGV in spider_conn_queue_and_merge_loop_check, and ASAN: heap-use-after-free in spider_conn_reset_queue_loop_check

          • Critical - Crashes, loss of data, severe memory leak.
          • Closed

          Activity

            Descending order - Click to sort in ascending order
            Roel Roel Van de Paar added a comment -

            Reduced the testcase further. No mysqld options required. Still only reproducible in reducer, not CLI nor MTR.

            SET sql_mode='';
            		 
            INSTALL PLUGIN Spider SONAME 'ha_spider.so';
            		 
            CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock',DATABASE'',USER 'Spider',PASSWORD 'PWD0');
            		 
            CREATE TABLE tSpider (a INT) ENGINE=Spider COMMENT='WRAPPER "mysql", SRV "srv", TABLE "t"';
            		 
            CREATE TABLE t1 (c1 BIGINT AUTO_INCREMENT NULL UNIQUE KEY);
            		 
            CREATE TABLE t5 (c1 INT, c2 CHAR(20)) ENGINE=Spider COMMENT='WRAPPER "mysql", TABLE "t"' COMMENT='WRAPPER "mysql", SRV "srv", TABLE "t"';
            		 
            XA START 'foo';
            		 
            SELECT * FROM information_schema.table_constraints;
            		 
            SELECT * FROM t5;
            		 
            SELECT SLEEP (1);
            		 
            SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC;
            		 
            SELECT SLEEP (1);
            		 
            SELECT * FROM t1 WHERE c1 BETWEEN '0000-00-00' AND '2010-00-01 00:00:00' ORDER BY c1 DESC;
            		 
            SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC;

            The issue seems to be around the c1 WHERE compare.

            Roel Roel Van de Paar added a comment - Reduced the testcase further. No mysqld options required. Still only reproducible in reducer, not CLI nor MTR. SET sql_mode= '' ; INSTALL PLUGIN Spider SONAME 'ha_spider.so' ; CREATE SERVER srv FOREIGN DATA WRAPPER MYSQL OPTIONS (SOCKET '../socket.sock' , DATABASE '' , USER 'Spider' , PASSWORD 'PWD0' ); CREATE TABLE tSpider (a INT ) ENGINE=Spider COMMENT= 'WRAPPER "mysql", SRV "srv", TABLE "t"' ; CREATE TABLE t1 (c1 BIGINT AUTO_INCREMENT NULL UNIQUE KEY ); CREATE TABLE t5 (c1 INT , c2 CHAR (20)) ENGINE=Spider COMMENT= 'WRAPPER "mysql", TABLE "t"' COMMENT= 'WRAPPER "mysql", SRV "srv", TABLE "t"' ; XA START 'foo' ; SELECT * FROM information_schema.table_constraints; SELECT * FROM t5; SELECT SLEEP (1); SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1= '16' ORDER BY c1 DESC ; SELECT SLEEP (1); SELECT * FROM t1 WHERE c1 BETWEEN '0000-00-00' AND '2010-00-01 00:00:00' ORDER BY c1 DESC ; SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1= '16' ORDER BY c1 DESC ; The issue seems to be around the c1 WHERE compare.
            Roel Roel Van de Paar added a comment -

            The issue seems to be character encoding related only, and not about Spider.

            Roel Roel Van de Paar added a comment - The issue seems to be character encoding related only, and not about Spider.
            Roel Roel Van de Paar added a comment -

            The sporadic SIGSEGV is in this code in /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h around line 111:

            /*
            		 
              Check if:
            		 
              - both strings "a" and "b" have at least 4 bytes, and
            		 
              - both strings have only 7bit data.
            		 
            */
            		 
            static inline int
            		 
            my_strcoll_ascii_4bytes_found(const uchar *a, const uchar *ae,
            		 
                                          const uchar *b, const uchar *be)
            		 
            {
            		 
              return a + 4 <= ae && b + 4 <= be        &&
            		 
                     (uint4korr(b) & 0x80808080) == 0  &&        ## << SIGSEGV location
            		 
                     (uint4korr(a) & 0x80808080) == 0;
            		 
            }

            Roel Roel Van de Paar added a comment - The sporadic SIGSEGV is in this code in /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h around line 111: /* Check if: - both strings "a" and "b" have at least 4 bytes, and - both strings have only 7bit data. */ static inline int my_strcoll_ascii_4bytes_found(const uchar *a, const uchar *ae, const uchar *b, const uchar *be) { return a + 4 <= ae && b + 4 <= be && (uint4korr(b) & 0x80808080) == 0 && ## << SIGSEGV location (uint4korr(a) & 0x80808080) == 0; }
            Roel Roel Van de Paar added a comment -

            Discussed with ycp who created test bb-11.6-mdev-32492-27902-29962, with thanks, to see if the bug still reproduces there. It does:

            11.6.0 0d7c712debbe5056da2c34b5daf3fbd5969d00dc (Optimized)

            		 
            Core was generated by `/test/MDEV-32492-27902-29962_MD100724-mariadb-11.6.0-linux-x86_64-opt/bin/maria'.
            		 
            Program terminated with signal SIGSEGV, Segmentation fault.
            		 
            #0  0x000055eb20ae1b3f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
                b=<optimized out>, ae=0x1477e8047810 "", a=<optimized out>)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h:111
            		 
            111	         (uint4korr(b) & 0x80808080) == 0  &&
            		 
            [Current thread is 1 (LWP 3686145)]
            		 
            (gdb) bt
            		 
            #0  0x000055eb20ae1b3f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, 
                b=<optimized out>, ae=0x1477e8047810 "", a=<optimized out>)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h:111
            		 
            #1  my_strnncoll_utf8mb3_bin (cs=<optimized out>, a=<optimized out>, a_length=<optimized out>, 
                b=<optimized out>, b_length=<optimized out>, b_is_prefix=0 '\000')
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/strcoll.inl:237
            		 
            #2  0x000055eb20a70632 in hashcmp (pos=0x1477e83e23a8, pos=0x1477e83e23a8, length=248, key=0x0, 
                hash=0x1477e804c288) at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:381
            		 
            #3  my_hash_first_from_hash_value (hash=0x1477e804c288, hash_value=<optimized out>, key=0x0, length=248, 
                current_record=current_record@entry=0x14781c1661ac)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:291
            		 
            #4  0x000055eb20a70705 in my_hash_search_using_hash_value (hash=<optimized out>, hash_value=<optimized out>, 
                key=<optimized out>, length=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:245
            		 
            #5  0x000014781c077929 in spider_conn_queue_and_merge_loop_check (conn=conn@entry=0x1477e804bab8, 
                lcptr=lcptr@entry=0x1477e8047538) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:1118
            		 
            #6  0x000014781c077e7d in spider_conn_reset_queue_loop_check (conn=0x1477e804bab8)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:1239
            		 
            #7  0x000014781c07809f in spider_reset_conn_setted_parameter (conn=<optimized out>, thd=<optimized out>)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:259
            		 
            #8  0x000014781c0639a6 in spider_db_connect (share=0x1477e80a65d8, conn=conn@entry=0x1477e804bab8, link_idx=0)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:131
            		 
            #9  0x000014781c064660 in spider_db_conn_queue_action (conn=conn@entry=0x1477e804bab8)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:256
            		 
            #10 0x000014781c069b80 in spider_db_before_query (conn=0x1477e804bab8, need_mon=<optimized out>)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:571
            		 
            #11 0x000014781c069d82 in spider_db_set_names_internal (trx=0x1477e81a5668, share=0x1477e8083bf8, 
                conn=conn@entry=0x1477e804bab8, all_link_idx=0, need_mon=0x1477e8016f38)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:799
            		 
            #12 0x000014781c069f39 in spider_db_set_names (spider=<optimized out>, conn=conn@entry=0x1477e804bab8, 
                link_idx=link_idx@entry=0) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:842
            		 
            #13 0x000014781c0e0749 in spider_mbase_handler::show_table_status (this=0x1477e806f140, link_idx=0, sts_mode=1, 
                flag=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_mysql.cc:13231
            		 
            #14 0x000014781c093584 in spider_get_sts (share=0x1477e8083bf8, link_idx=0, tmp_time=tmp_time@entry=1720556507, 
                spider=spider@entry=0x1477e8088830, sts_interval=sts_interval@entry=0, sts_mode=sts_mode@entry=1, 
                sts_sync=sts_sync@entry=0, sts_sync_level=1, flag=82)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_table.cc:7153
            		 
            #15 0x000014781c0c26f7 in ha_spider::info (this=0x1477e8088830, flag=18)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/ha_spider.cc:6560
            		 
            #16 0x000055eb20313ba1 in make_join_statistics (join=join@entry=0x1477e8019fd0, tables_list=..., 
                keyuse_array=keyuse_array@entry=0x1477e801a328)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:5611
            		 
            #17 0x000055eb2031ab72 in JOIN::optimize_inner (this=this@entry=0x1477e8019fd0)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:2683
            		 
            #18 0x000055eb2031b31a in JOIN::optimize (this=this@entry=0x1477e8019fd0)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:1984
            		 
            #19 0x000055eb2031b411 in mysql_select (thd=thd@entry=0x1477e8000c68, tables=0x1477e80189c8, fields=..., 
                conds=0x1477e8019298, og_num=1, order=0x1477e8019e50, group=0x0, having=0x0, proc_param=0x0, 
                select_options=<optimized out>, result=0x1477e8019fa8, unit=0x1477e8004f88, select_lex=0x1477e8017fc8)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:5320
            		 
            #20 0x000055eb2031bc64 in handle_select (thd=thd@entry=0x1477e8000c68, lex=lex@entry=0x1477e8004ea8, 
                result=result@entry=0x1477e8019fa8, setup_tables_done_option=setup_tables_done_option@entry=0)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:628
            		 
            #21 0x000055eb2028de75 in execute_sqlcom_select (thd=thd@entry=0x1477e8000c68, all_tables=0x1477e80189c8)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:6147
            		 
            #22 0x000055eb2029d10f in mysql_execute_command (thd=thd@entry=0x1477e8000c68, 
                is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:3953
            		 
            #23 0x000055eb2029e626 in mysql_parse (thd=0x1477e8000c68, rawbuf=<optimized out>, length=<optimized out>, 
                parser_state=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:7867
            		 
            #24 0x000055eb202a0805 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1477e8000c68, 
                packet=packet@entry=0x1477e8008859 "SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC", 
                packet_length=packet_length@entry=62, blocking=blocking@entry=true)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:1991
            		 
            #25 0x000055eb202a2df0 in do_command (thd=0x1477e8000c68, blocking=blocking@entry=true)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:1405
            		 
            #26 0x000055eb203d269f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55eb229516c8, 
                put_in_cache=put_in_cache@entry=true) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_connect.cc:1447
            		 
            #27 0x000055eb203d29ed in handle_one_connection (arg=arg@entry=0x55eb229516c8)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_connect.cc:1349
            		 
            #28 0x000055eb20788ecd in pfs_spawn_thread (arg=0x55eb2290ba38)
            		 
                at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/perfschema/pfs.cc:2198
            		 
            #29 0x0000147841697ada in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444
            		 
            #30 0x000014784172847c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

            Roel Roel Van de Paar added a comment - Discussed with ycp who created test bb-11.6-mdev-32492-27902-29962, with thanks, to see if the bug still reproduces there. It does: 11.6.0 0d7c712debbe5056da2c34b5daf3fbd5969d00dc (Optimized) Core was generated by `/test/MDEV-32492-27902-29962_MD100724-mariadb-11.6.0-linux-x86_64-opt/bin/maria'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055eb20ae1b3f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, b=<optimized out>, ae=0x1477e8047810 "", a=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h:111 111 (uint4korr(b) & 0x80808080) == 0 && [Current thread is 1 (LWP 3686145)] (gdb) bt #0 0x000055eb20ae1b3f in my_strcoll_ascii_4bytes_found (be=0xf8 <error: Cannot access memory at address 0xf8>, b=<optimized out>, ae=0x1477e8047810 "", a=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/ctype-ascii.h:111 #1 my_strnncoll_utf8mb3_bin (cs=<optimized out>, a=<optimized out>, a_length=<optimized out>, b=<optimized out>, b_length=<optimized out>, b_is_prefix=0 '\000') at /test/bb-11.6-mdev-32492-27902-29962_opt/strings/strcoll.inl:237 #2 0x000055eb20a70632 in hashcmp (pos=0x1477e83e23a8, pos=0x1477e83e23a8, length=248, key=0x0, hash=0x1477e804c288) at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:381 #3 my_hash_first_from_hash_value (hash=0x1477e804c288, hash_value=<optimized out>, key=0x0, length=248, current_record=current_record@entry=0x14781c1661ac) at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:291 #4 0x000055eb20a70705 in my_hash_search_using_hash_value (hash=<optimized out>, hash_value=<optimized out>, key=<optimized out>, length=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/mysys/hash.c:245 #5 0x000014781c077929 in spider_conn_queue_and_merge_loop_check (conn=conn@entry=0x1477e804bab8, lcptr=lcptr@entry=0x1477e8047538) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:1118 #6 0x000014781c077e7d in spider_conn_reset_queue_loop_check (conn=0x1477e804bab8) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:1239 #7 0x000014781c07809f in spider_reset_conn_setted_parameter (conn=<optimized out>, thd=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_conn.cc:259 #8 0x000014781c0639a6 in spider_db_connect (share=0x1477e80a65d8, conn=conn@entry=0x1477e804bab8, link_idx=0) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:131 #9 0x000014781c064660 in spider_db_conn_queue_action (conn=conn@entry=0x1477e804bab8) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:256 #10 0x000014781c069b80 in spider_db_before_query (conn=0x1477e804bab8, need_mon=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:571 #11 0x000014781c069d82 in spider_db_set_names_internal (trx=0x1477e81a5668, share=0x1477e8083bf8, conn=conn@entry=0x1477e804bab8, all_link_idx=0, need_mon=0x1477e8016f38) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:799 #12 0x000014781c069f39 in spider_db_set_names (spider=<optimized out>, conn=conn@entry=0x1477e804bab8, link_idx=link_idx@entry=0) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_conn.cc:842 #13 0x000014781c0e0749 in spider_mbase_handler::show_table_status (this=0x1477e806f140, link_idx=0, sts_mode=1, flag=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_db_mysql.cc:13231 #14 0x000014781c093584 in spider_get_sts (share=0x1477e8083bf8, link_idx=0, tmp_time=tmp_time@entry=1720556507, spider=spider@entry=0x1477e8088830, sts_interval=sts_interval@entry=0, sts_mode=sts_mode@entry=1, sts_sync=sts_sync@entry=0, sts_sync_level=1, flag=82) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/spd_table.cc:7153 #15 0x000014781c0c26f7 in ha_spider::info (this=0x1477e8088830, flag=18) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/spider/ha_spider.cc:6560 #16 0x000055eb20313ba1 in make_join_statistics (join=join@entry=0x1477e8019fd0, tables_list=..., keyuse_array=keyuse_array@entry=0x1477e801a328) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:5611 #17 0x000055eb2031ab72 in JOIN::optimize_inner (this=this@entry=0x1477e8019fd0) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:2683 #18 0x000055eb2031b31a in JOIN::optimize (this=this@entry=0x1477e8019fd0) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:1984 #19 0x000055eb2031b411 in mysql_select (thd=thd@entry=0x1477e8000c68, tables=0x1477e80189c8, fields=..., conds=0x1477e8019298, og_num=1, order=0x1477e8019e50, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x1477e8019fa8, unit=0x1477e8004f88, select_lex=0x1477e8017fc8) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:5320 #20 0x000055eb2031bc64 in handle_select (thd=thd@entry=0x1477e8000c68, lex=lex@entry=0x1477e8004ea8, result=result@entry=0x1477e8019fa8, setup_tables_done_option=setup_tables_done_option@entry=0) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_select.cc:628 #21 0x000055eb2028de75 in execute_sqlcom_select (thd=thd@entry=0x1477e8000c68, all_tables=0x1477e80189c8) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:6147 #22 0x000055eb2029d10f in mysql_execute_command (thd=thd@entry=0x1477e8000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:3953 #23 0x000055eb2029e626 in mysql_parse (thd=0x1477e8000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:7867 #24 0x000055eb202a0805 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1477e8000c68, packet=packet@entry=0x1477e8008859 "SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC", packet_length=packet_length@entry=62, blocking=blocking@entry=true) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:1991 #25 0x000055eb202a2df0 in do_command (thd=0x1477e8000c68, blocking=blocking@entry=true) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_parse.cc:1405 #26 0x000055eb203d269f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55eb229516c8, put_in_cache=put_in_cache@entry=true) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_connect.cc:1447 #27 0x000055eb203d29ed in handle_one_connection (arg=arg@entry=0x55eb229516c8) at /test/bb-11.6-mdev-32492-27902-29962_opt/sql/sql_connect.cc:1349 #28 0x000055eb20788ecd in pfs_spawn_thread (arg=0x55eb2290ba38) at /test/bb-11.6-mdev-32492-27902-29962_opt/storage/perfschema/pfs.cc:2198 #29 0x0000147841697ada in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:444 #30 0x000014784172847c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
            Roel Roel Van de Paar added a comment -

            bar Any ideas what may be happening here (ref my_strcoll_ascii_4bytes_found)? Thanks!

            Roel Roel Van de Paar added a comment - bar Any ideas what may be happening here (ref my_strcoll_ascii_4bytes_found)? Thanks!
            Roel Roel Van de Paar added a comment - - edited

            Given that the issue reproduces on 11.5 (confirmed twice) it is not related to MDEV-19123.

            Roel Roel Van de Paar added a comment - - edited Given that the issue reproduces on 11.5 (confirmed twice) it is not related to MDEV-19123 .
            Roel Roel Van de Paar added a comment - - edited

            The testcase, when executed on debug, non-sporadically reproduces 

            SIGSEGV|spider_conn_queue_and_merge_loop_check|spider_conn_reset_queue_loop_check|spider_reset_conn_setted_parameter|spider_db_connect

            Which we have seen in MDEV-27902. Still, the optimized issue as per above looks very different and possibly unrelated.

            UPDATE: when the testcase is looped manually, it can also crash in an opt (not just dbg) build on the same stack, but the crash will be on a different query:

            bb-11.6-mdev-32492-27902-29962 0d7c712debbe5056da2c34b5daf3fbd5969d00dc (Optimized)

            		 
            11.6.0-opt>SELECT * FROM information_schema.table_constraints;
            		 
            ERROR 2026 (HY000): TLS/SSL error: The TLS connection was non-properly terminated.
            		 
            11.6.0-opt>SELECT * FROM t2;
            		 
            ERROR 2006 (HY000): Server has gone away

            That stack looks like a different bug. (t5 was changed to t2 here). ycp Please note that the stack is listed in MDEV-27902, however it is not fixed in bb-11.6-mdev-32492-27902-29962, so this was moved to a new ticket MDEV-34555 (SIGSEGV in spider_conn_queue_and_merge_loop_check).

            Then again, confusingly, on 10.6 debug for example we see the same crash on the SELECT being discussed in this bug:

            10.6.19 83d3ed4908836ff1613208037ff29c8ae3b2e04d (Debug)

            		 
            10.6.19-dbg>SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC;
            		 
            ERROR 2013 (HY000): Lost connection to server during query

            The opt vs dbg makes a difference, and it may be that the given SELECT ... WHERE query can trigger two erroneous states, one related to character encoding and the other to spider_conn_queue_and_merge_loop_check.

            Roel Roel Van de Paar added a comment - - edited The testcase, when executed on debug, non-sporadically reproduces SIGSEGV|spider_conn_queue_and_merge_loop_check|spider_conn_reset_queue_loop_check|spider_reset_conn_setted_parameter|spider_db_connect Which we have seen in MDEV-27902 . Still, the optimized issue as per above looks very different and possibly unrelated. UPDATE : when the testcase is looped manually, it can also crash in an opt (not just dbg) build on the same stack, but the crash will be on a different query: bb-11.6-mdev-32492-27902-29962 0d7c712debbe5056da2c34b5daf3fbd5969d00dc (Optimized) 11.6.0-opt>SELECT * FROM information_schema.table_constraints; ERROR 2026 (HY000): TLS/SSL error: The TLS connection was non-properly terminated. 11.6.0-opt>SELECT * FROM t2; ERROR 2006 (HY000): Server has gone away That stack looks like a different bug. (t5 was changed to t2 here). ycp Please note that the stack is listed in MDEV-27902 , however it is not fixed in bb-11.6-mdev-32492-27902-29962, so this was moved to a new ticket MDEV-34555 (SIGSEGV in spider_conn_queue_and_merge_loop_check). Then again, confusingly, on 10.6 debug for example we see the same crash on the SELECT being discussed in this bug: 10.6.19 83d3ed4908836ff1613208037ff29c8ae3b2e04d (Debug) 10.6.19-dbg>SELECT HEX(c1),HEX (c2) FROM t5 WHERE c1='16' ORDER BY c1 DESC; ERROR 2013 (HY000): Lost connection to server during query The opt vs dbg makes a difference, and it may be that the given SELECT ... WHERE query can trigger two erroneous states, one related to character encoding and the other to spider_conn_queue_and_merge_loop_check .

            People

              bar Alexander Barkov
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.