Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-34706

Upgrade from MySQL 5.7 to MariaDB 11.4.2 leads to crash

Details

    Description

      For our MariaDB 11.4 presentation at FrOSCon 2024 we did a physical test upgrade of one of our MySQL 5.7 databases and it miserably failed.

      Steps to reproduce:

      • Stop MariaDB 11.4 and MySQL 5.7
      • Copy over the data
      • Start MariaDB 11.4
      • run mariadb-upgrade --user=root --force -> successful
      • run mariadb-upgrade --uer=root --force again -> failed
        ...
        mariadb-check: Got error: 2026: TLS/SSL error: The TLS connection was non-properly terminated. when executing 'CHECK TABLE ... FOR UPGRADE'
        FATAL ERROR: Upgrade failed

      MariaDB error log:

      2024-08-05 16:12:40 0 [Note] Starting MariaDB 11.4.2-MariaDB-log source revision 3fca5ed772fb75e3e57c507edef2985f8eba5b12 as process 504543
      2024-08-05 16:12:40 0 [Note] InnoDB: Compressed tables use zlib 1.3.1
      2024-08-05 16:12:40 0 [Note] InnoDB: Number of transaction pools: 1
      2024-08-05 16:12:40 0 [Note] InnoDB: Using crc32 + pclmulqdq instructions
      2024-08-05 16:12:40 0 [Note] InnoDB: Using Linux native AIO
      2024-08-05 16:12:40 0 [Note] InnoDB: Initializing buffer pool, total size = 128.000MiB, chunk size = 2.000MiB
      2024-08-05 16:12:40 0 [Note] InnoDB: Completed initialization of buffer pool
      2024-08-05 16:12:40 0 [Note] InnoDB: Buffered log writes (block size=512 bytes)
      2024-08-05 16:12:40 0 [Note] InnoDB: Upgrading redo log: 256.000MiB; LSN=39606720606
      2024-08-05 16:12:40 0 [Note] InnoDB: Buffered log writes (block size=512 bytes)
      2024-08-05 16:12:40 0 [Note] InnoDB: Upgrading the change buffer
      2024-08-05 16:12:42 0 [Note] InnoDB: Upgraded the change buffer: 0 tablespaces, 0 pages
      2024-08-05 16:12:42 0 [Note] InnoDB: Reinitializing innodb_undo_tablespaces= 3 from 0
      2024-08-05 16:12:42 0 [Note] InnoDB: Data file .//undo001 did not exist: new to be created
      2024-08-05 16:12:42 0 [Note] InnoDB: Setting file .//undo001 size to 10.000MiB
      2024-08-05 16:12:42 0 [Note] InnoDB: Database physically writes the file full: wait...
      2024-08-05 16:12:42 0 [Note] InnoDB: Data file .//undo002 did not exist: new to be created
      2024-08-05 16:12:42 0 [Note] InnoDB: Setting file .//undo002 size to 10.000MiB
      2024-08-05 16:12:42 0 [Note] InnoDB: Database physically writes the file full: wait...
      2024-08-05 16:12:42 0 [Note] InnoDB: Data file .//undo003 did not exist: new to be created
      2024-08-05 16:12:42 0 [Note] InnoDB: Setting file .//undo003 size to 10.000MiB
      2024-08-05 16:12:42 0 [Note] InnoDB: Database physically writes the file full: wait...
      2024-08-05 16:12:42 0 [Note] InnoDB: 128 rollback segments in 3 undo tablespaces are active.
      2024-08-05 16:12:42 0 [Note] InnoDB: Setting file './ibtmp1' size to 12.000MiB. Physically writing the file full; Please wait ...
      2024-08-05 16:12:42 0 [Note] InnoDB: File './ibtmp1' size is now 12.000MiB.
      2024-08-05 16:12:42 0 [Note] InnoDB: log sequence number 39606720606; transaction id 28108546
      2024-08-05 16:12:42 0 [Note] InnoDB: Loading buffer pool(s) from /home/mysql/database/mariadb-114/data/ib_buffer_pool
      2024-08-05 16:12:42 0 [Note] Plugin 'FEEDBACK' is disabled.
      2024-08-05 16:12:42 0 [Note] Plugin 'wsrep-provider' is disabled.
      2024-08-05 16:12:42 0 [Note] Recovering after a crash using /home/mysql/database/mariadb-114/binlog/chef_mariadb-114_binlog
      2024-08-05 16:12:42 0 [Note] Starting table crash recovery...
      2024-08-05 16:12:42 0 [Note] Crash table recovery finished.
      2024-08-05 16:12:42 1 [Warning] Failed to load slave replication state from table mysql.gtid_slave_pos: 1146: Table 'mysql.gtid_slave_pos' doesn't exist
      2024-08-05 16:12:42 0 [Note] InnoDB: Buffer pool(s) load completed at 240805 16:12:42
      2024-08-05 16:12:44 0 [Note] Server socket created on IP: '0.0.0.0'.
      2024-08-05 16:12:44 0 [Note] Server socket created on IP: '::'.
      2024-08-05 16:12:44 0 [ERROR] Missing system table mysql.roles_mapping; please run mysql_upgrade to create it
      2024-08-05 16:12:44 0 [ERROR] Incorrect definition of table mysql.event: expected column 'definer' at position 3 to have type varchar(, found type char(93).
      2024-08-05 16:12:44 0 [ERROR] Incorrect definition of table mysql.event: expected column 'sql_mode' at position 14 to have type set('REAL_AS_FLOAT','PIPES_AS_CONCAT','ANSI_QUOTES','IGNORE_SPACE','IGNORE_BAD_TABLE_OPTIONS','ONLY_FULL_GROUP_BY','NO_UNSIGNED_SUBTRACTION','NO_DIR_IN_CREATE','POSTGRESQL','ORACLE','MSSQL','DB2','MAXDB','NO_KEY_OPTIONS','NO_TABLE_OPTIONS','NO_FIELD_OPTIONS','MYSQL323','MYSQL40','ANSI','NO_AUTO_VALUE_ON_ZERO','NO_BACKSLASH_ESCAPES','STRICT_TRANS_TABLES','STRICT_ALL_TABLES','NO_ZERO_IN_DATE','NO_ZERO_DATE','INVALID_DATES','ERROR_FOR_DIVISION_BY_ZERO','TRADITIONAL','NO_AUTO_CREATE_USER','HIGH_NOT_PRECEDENCE','NO_ENGINE_SUBSTITUTION','PAD_CHAR_TO_FULL_LENGTH','EMPTY_STRING_IS_NULL','SIMULTANEOUS_ASSIGNMENT'), found type set('REAL_AS_FLOAT','PIPES_AS_CONCAT','ANSI_QUOTES','IGNORE_SPACE','NOT_USED','ONLY_FULL_GROUP_BY','NO_UNSIGNED_SUBTRACTION','NO_DIR_IN_CREATE','POSTGRESQL','ORACLE','MSSQL','DB2','MAXDB','NO_KEY_OPTIONS','NO_TABLE_OPTIONS','NO_FIELD_OPTIONS','MYSQL323','MYSQL40','ANSI','NO_AUTO_VALUE_ON_ZERO','NO_B
      2024-08-05 16:12:44 0 [ERROR] mariadbd: Event Scheduler: An error occurred when initializing system tables. Disabling the Event Scheduler.
      2024-08-05 16:12:44 2 [Warning] Failed to load slave replication state from table mysql.gtid_slave_pos: 1146: Table 'mysql.gtid_slave_pos' doesn't exist
      2024-08-05 16:12:44 0 [Note] bin/mariadbd: ready for connections.
      Version: '11.4.2-MariaDB-log' socket: '/run/mariadb/mariadb-3358.sock' port: 3358 MariaDB Server
      2024-08-05 16:12:45 4 [Warning] Aborted connection 4 to db: 'unconnected' user: 'unauthenticated' host: 'localhost' (This connection closed normally without authentication)
      2024-08-05 16:13:11 13 [Note] mariadbd: Event Scheduler: Loaded 0 events
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 32 on table `crm`.`campaign_trkrs` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 31 on table `crm`.`campaigns` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1 on table `crm`.`cases` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 8985 on table `crm`.`prospects` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 35442 on table `crm`.`tracker` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1526 on table `test`.`employee` (created with version 50741)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1 on table `test`.`jsonptntest#P#p_2021` (created with version 50741)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 2 on table `test`.`jsonptntest#P#p_2022` (created with version 50741)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 3 on table `test`.`jsonptntest#P#p_2023` (created with version 50741)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1310693 on table `test`.`t1` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1048576 on table `test`.`t2` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 1048576 on table `test`.`t3` (created with version 50744)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 10 on table `test`.`team` (created with version 50741)
      2024-08-05 16:13:21 16 [Note] InnoDB: Resetting PAGE_ROOT_AUTO_INC from 0 to 2424796 on table `test`.`test` (created with version 50741)
      2024-08-05 16:13:36 26 [ERROR] mariadbd: Table rebuild required. Please do "ALTER TABLE `test.jsonptntest` FORCE" or dump/reload to fix it!
      240805 16:13:51 [ERROR] mysqld got signal 11 ;
      Sorry, we probably made a mistake, and this is a bug.

      Your assistance in bug reporting will enable us to fix this for the next release.
      To report this bug, see https://mariadb.com/kb/en/reporting-bugs

      We will try our best to scrape up some info that will hopefully help
      diagnose the problem, but since we have already crashed,
      something is definitely wrong and this may fail.

      Server version: 11.4.2-MariaDB-log source revision: 3fca5ed772fb75e3e57c507edef2985f8eba5b12
      key_buffer_size=8388608
      read_buffer_size=131072
      max_used_connections=1
      max_threads=153
      thread_count=1
      It is possible that mysqld could use up to
      key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 345186 K bytes of memory
      Hope that's ok; if not, decrease some variables in the equation.

      Thread pointer: 0x7fb8b8000c68
      Attempting backtrace. You can use the following information to find out
      where mysqld died. If you see no messages after this, something went
      terribly wrong...
      stack_bottom = 0x7fb8f811bc80 thread_stack 0x49000
      addr2line: 'bin/mariadbd': No such file
      Printing to addr2line failed
      bin/mariadbd(my_print_stacktrace+0x2e)[0x5a9492ae04e]
      bin/mariadbd(handle_fatal_signal+0x2f7)[0x55a948cf1f47]
      libc_sigaction.c:0(__restore_rt)[0x7fb90e7ac520]
      addr2line: 'bin/mariadbd': No such file
      bin/mariadbd(_Z8closefrmP5TABLE+0xa0)[0x55a948b733d0]
      bin/mariadbd(+0xa6cb76)[0x55a948c6cb76]
      bin/mariadbd(_Z19close_thread_tablesP3THD+0x1db)[0x55a948a2357b]
      bin/mariadbd(+0x9bcf73)[0x55a948bbcf73]
      bin/mariadbd(_ZN19Sql_cmd_check_table7executeEP3THD+0xae)[0x55a948bbe98e]
      bin/mariadbd(_Z21mysql_execute_commandP3THDb+0x1bac)[0x55a948a988ac]
      bin/mariadbd(_Z11mysql_parseP3THDPcjP12Parser_state+0x20b)[0x55a948a9bbbb]
      bin/mariadbd(_Z16dispatch_command19enum_server_commandP3THDPcjb+0x1654)[0x55a948a9e1b4]
      bin/mariadbd(_Z10do_commandP3THDb+0x123)[0x55a948a9f5f3]
      bin/mariadbd(_Z24do_handle_one_connectionP7CONNECTb+0x187)[0x55a948bafa37]
      bin/mariadbd(handle_one_connection+0x34)[0x55a948bafcd4]
      bin/mariadbd(+0xd48f4c)[0x55a948f48f4c]
      nptl/pthread_create.c:442(start_thread)[0x7fb90e7feac3]
      x86_64/clone3.S:83(__clone3)[0x7fb90e890850]

      Trying to get some variables.
      Some pointers may be invalid and cause the dump to abort.
      Query (0x7fb8b801bb50): CHECK TABLE `jsonptntest` FOR UPGRADE

      Connection ID (thread ID): 30
      Status: NOT_KILLED

      Optimizer switch: index_merge=on,index_merge_union=on,index_merge_sort_union=on,index_merge_intersection=on,index_merge_sort_intersection=off,index_condition_pushdown=on,derived_merge=on,derived_with_keys=on,firstmatch=on,loosescan=on,materialization=on,in_to_exists=on,semijoin=on,partial_match_rowid_merge=on,partial_match_table_scan=on,subquery_cache=on,mrr=off,mrr_cost_based=off,mrr_sort_keys=off,outer_join_with_cache=on,semijoin_with_cache=on,join_cache_incremental=on,join_cache_hashed=on,join_cache_bka=on,optimize_join_buffer_size=on,table_elimination=on,extended_keys=on,exists_to_in=on,orderby_uses_equalities=on,condition_pushdown_for_derived=on,split_materialized=on,condition_pushdown_for_subquery=on,rowid_filter=on,condition_pushdown_from_having=on,not_null_range_scan=off,hash_join_cardinality=on,cset_narrowing=off,sargable_casefold=on

      The manual page at https://mariadb.com/kb/en/how-to-produce-a-full-stack-trace-for-mariadbd/ contains
      information that should help you find out what is causing the crash.
      Writing a core file...
      Working directory at /home/mysql/database/mariadb-114/data
      Resource Limits:
      Limit Soft Limit Hard Limit Units
      Max cpu time unlimited unlimited seconds
      Max file size unlimited unlimited bytes
      Max data size unlimited unlimited bytes
      Max stack size 8388608 unlimited bytes
      Max core file size 0 0 bytes
      Max resident set unlimited unlimited bytes
      Max processes 62207 62207 processes
      Max open files 64186 64186 files
      Max locked memory 2054037504 2054037504 bytes
      Max address space unlimited unlimited bytes
      Max file locks unlimited unlimited locks
      Max pending signals 62207 62207 signals
      Max msgqueue size 819200 819200 bytes
      Max nice priority 0 0
      Max realtime priority 0 0
      Max realtime timeout unlimited unlimited us
      Core pattern: |/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g – %E

      Kernel version: Linux version 5.15.0-117-generic (buildd@lcy02-amd64-102) (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #127-Ubuntu SMP Fri Jul 5 20:13:28 UTC 2024

      We could repeat the crash 3 times in a row.

      tar.gz of database can be provided on demand (500 M).

      Attachments

        Issue Links

          Activity

            alice Alice Sherepa added a comment -

            Could you please provide the output of SHOW CREATE TABLE jsonptntest;

            alice Alice Sherepa added a comment - Could you please provide the output of SHOW CREATE TABLE jsonptntest;

            Hi Alice

            CREATE TABLE `jsonptntest` (
            `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
            `data` json DEFAULT NULL,
            `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
            PRIMARY KEY (`id`,`ts`),
            KEY `ts` (`ts`)
            ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=latin1
            /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts))
            (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = InnoDB,
            PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = InnoDB,
            PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = InnoDB,
            PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = InnoDB,
            PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = InnoDB) */

            I see... OK, JSON is a weak spot in migration. But then I would expect at least an error message and not a server crash...

            oli Oli Sennhauser added a comment - Hi Alice CREATE TABLE `jsonptntest` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `data` json DEFAULT NULL, `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, PRIMARY KEY (`id`,`ts`), KEY `ts` (`ts`) ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=latin1 /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts)) (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = InnoDB, PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = InnoDB, PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = InnoDB, PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = InnoDB, PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = InnoDB) */ I see... OK, JSON is a weak spot in migration. But then I would expect at least an error message and not a server crash...
            danblack Daniel Black added a comment -

            11.4-5ab81ffe0097a22a774957df28c5223cf0201de3

            Program terminated with signal SIGSEGV, Segmentation fault.
            #0  0x0000000000811143 in closefrm (table=table@entry=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table.cc:4770
            4770	      delete *ptr;
            [Current thread is 1 (Thread 0x7f1ae55696c0 (LWP 726382))]
            Missing separate debuginfos, use: dnf debuginfo-install glibc-2.39-17.fc40.x86_64 libcap-2.69-8.fc40.x86_64 libgcc-14.1.1-7.fc40.x86_64 libstdc++-14.1.1-7.fc40.x86_64 liburing-2.5-3.fc40.x86_64 libxcrypt-4.4.36-5.fc40.x86_64 libxml2-2.12.8-1.fc40.x86_64 libzstd-1.5.6-1.fc40.x86_64 openssl-libs-3.2.1-2.fc40.x86_64 pcre2-10.44-1.fc40.x86_64 systemd-libs-255.8-1.fc40.x86_64 xz-libs-5.4.6-3.fc40.x86_64
            (gdb) p ptr
            $1 = (Field **) 0x7f1a7c2d61e8
            (gdb) bt
            #0  0x0000000000811143 in closefrm (table=table@entry=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table.cc:4770
            #1  0x00000000008f3734 in intern_close_table (table=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table_cache.cc:230
            #2  tc_remove_table (table=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table_cache.cc:268
            #3  0x00000000006cac1b in close_thread_tables (thd=thd@entry=0x7f1a7c000c68) at /home/dan/repos/mariadb-server-11.4/sql/sql_base.cc:984
            #4  0x000000000084e8dc in mysql_admin_table (thd=thd@entry=0x7f1a7c000c68, tables=tables@entry=0x7f1a7c032e38, check_opt=check_opt@entry=0x7f1a7c006240, operator_name=0xfd5bd0 <msg_check>, 
                lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=<optimized out>, extra_open_options=32, prepare_func=0x0, 
                operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x976820 <handler::ha_check(THD*, st_ha_check_opt*)>, view_operator_func=0x806830 <view_check(THD*, TABLE_LIST*, st_ha_check_opt*)>, 
                is_cmd_replicated=<optimized out>) at /home/dan/repos/mariadb-server-11.4/sql/sql_admin.cc:1409
            #5  0x000000000084fb6a in Sql_cmd_check_table::execute (this=<optimized out>, thd=0x7f1a7c000c68) at /home/dan/repos/mariadb-server-11.4/sql/sql_admin.cc:1592
            #6  0x0000000000731d37 in mysql_execute_command (thd=thd@entry=0x7f1a7c000c68, is_called_from_prepared_stmt=false) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:5837
            #7  0x000000000072ee25 in mysql_parse (thd=thd@entry=0x7f1a7c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f1ae5568530)
                at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:7864
            #8  0x000000000072d3b0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f1a7c000c68, packet=packet@entry=0x7f1a7c007fc9 "", packet_length=packet_length@entry=38, blocking=true)
                at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:1894
            #9  0x000000000072f18f in do_command (thd=0x7f1a7c000c68, blocking=<optimized out>) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:1407
            #10 0x0000000000841eee in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1a7d7a18, put_in_cache=true) at /home/dan/repos/mariadb-server-11.4/sql/sql_connect.cc:1439
            #11 0x0000000000841d0b in handle_one_connection (arg=arg@entry=0x1a7d7a18) at /home/dan/repos/mariadb-server-11.4/sql/sql_connect.cc:1341
            #12 0x0000000000b5680e in pfs_spawn_thread (arg=0x1a74ff28) at /home/dan/repos/mariadb-server-11.4/storage/perfschema/pfs.cc:2201
            #13 0x00007f1ae7ea6507 in start_thread () from /lib64/libc.so.6
            #14 0x00007f1ae7f2a40c in clone3 () from /lib64/libc.so.6
            (gdb) p *ptr
            $2 = (Field *) 0x7f1a7c2d63e0
            (gdb) p **ptr
            $3 = {<Value_source> = {<No data fields>}, _vptr$Field = 0x7f1ae88e46e8, ptr = 0x7f1a7c2d61b5 "", null_ptr = 0x7f1a7c2d61b0 "\377", table = 0x7f1a7c3cfe88, orig_table = 0x7f1a7c3cfe88, table_name = 0x7f1a7c3cff98, 
              field_name = {str = 0x7f1a7c3a7714 "data", length = 4}, comment = {str = 0xf44561 "", length = 0}, option_list = 0x0, option_struct = 0x0, key_start = {buffer = {0}}, part_of_key = {buffer = {0}}, 
              part_of_key_not_clustered = {buffer = {0}}, part_of_sortkey = {buffer = {0}}, unireg_check = 20, invisible = VISIBLE, field_length = 4294967295, flags = 144, field_index = 1, null_bit = 1 '\001', 
              is_created_from_null_item = false, cond_selectivity = 1, next_equal_field = 0x0, read_stats = 0x0, collected_stats = 0x0, vcol_info = 0x0, check_constraint = 0x0, default_value = 0x0}
            (gdb) list
            4765	    table->expr_arena->free_items();
            4766	  if (table->field)
            4767	  {
            4768	    for (Field **ptr=table->field ; *ptr ; ptr++)
            4769	    {
            4770	      delete *ptr;
            4771	    }
            4772	    table->field= 0;
            4773	  }
            4774	  delete table->file;
            (gdb) p *ptr->table
            $4 = {s = 0x7f1a7c2d7030, file = 0x7f1a7c2bf370, next = 0x0, prev = 0x7f1a7c03e280, share_all_next = 0x0, share_all_prev = 0x7f1a7c03e238, global_free_next = 0x7f1a7c02cdd8, global_free_prev = 0x1a0b78f8, 
              instance = 0, in_use = 0x7f1a7c000c68, record = {0x7f1a7c2d61b0 "\377", 0x7f1a7c2d61c8 "", 0x7f1a7c2d61c8 ""}, write_row_record = 0x0, insert_values = 0x0, covering_keys = {buffer = {0}}, intersect_keys = {
                buffer = {0}}, keys_in_use_for_query = {buffer = {0}}, keys_in_use_for_group_by = {buffer = {0}}, keys_in_use_for_order_by = {buffer = {0}}, constraint_dependent_keys = {buffer = {0}}, key_info = 0x7f1a7c20acc0, 
            

            Looking at sequence of sql emitted by mariadb-upgrade --force

            $ grep json /tmp/build-mariadb-server-11.4-datadir/bark.log
            		    12 Query	INSTALL SONAME 'type_mysql_json'
                DECLARE json_objects LONGTEXT;
                INTO json_objects
                                        CONCAT('"events": [', IFNULL(json_objects,''), ']')
            		    16 Query	CHECK TABLE `jsonptntest`  FOR UPGRADE
            		    16 Query	REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`
            		    19 Query	UNINSTALL SONAME 'type_mysql_json'
                DECLARE json_objects LONGTEXT;
                INTO json_objects
                                        CONCAT('"events": [', IFNULL(json_objects,''), ']')
            		    30 Query	CHECK TABLE `jsonptntest`  FOR UPGRADE
            

            10.5-8b51d34462370b96af420587fdc07934abcea8ba

            $ podman volume create m57; podman run --rm -v m57:/var/lib/mysql:Z -e MYSQL_ROOT_PASSWORD=root --name m57 -d mysql:5.7
            m57
            04417a270bb521a14048091353495fdb9357f5f62bd066d94ea3e8c3d6bbce48
             
            $ podman exec -ti m57 mysql -proot
            mysql: [Warning] Using a password on the command line interface can be insecure.
            Welcome to the MySQL monitor.  Commands end with ; or \g.
            Your MySQL connection id is 2
            Server version: 5.7.44 MySQL Community Server (GPL)
             
            Copyright (c) 2000, 2023, Oracle and/or its affiliates.
             
            Oracle is a registered trademark of Oracle Corporation and/or its
            affiliates. Other names may be trademarks of their respective
            owners.
             
            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
             
            mysql> create database test;
            Query OK, 1 row affected (0.00 sec)
             
            mysql> use test;
            Database changed
            mysql> CREATE TABLE `jsonptntest` (
                -> `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
                -> `data` json DEFAULT NULL,
                -> `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
                -> PRIMARY KEY (`id`,`ts`),
                -> KEY `ts` (`ts`)
                -> ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=latin1
                -> /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts))
                -> (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = InnoDB,
                -> PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = InnoDB,
                -> PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = InnoDB,
                -> PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = InnoDB,
                -> PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = InnoDB) */;
            Query OK, 0 rows affected (0.05 sec)
             
            mysql> shutdown;
            Query OK, 0 rows affected (0.00 sec)
             
            $  podman run --rm -v m57:/var/lib/mysql:Z --name mariadb -d quay.io/mariadb-foundation/mariadb-devel:earliest
            8c3e923f123a6d0dd8402133bdf2d26702a54c734815756331e798207cc969e8
             
            $ podman logs mariadb
            2024-08-06 01:54:28+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.5.26+maria~ubu2004 started.
            2024-08-06 01:54:30+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql'
            2024-08-06 01:54:30+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.5.26+maria~ubu2004 started.
            2024-08-06 01:54:31+00:00 [Note] [Entrypoint]: MariaDB upgrade information missing, assuming required
            ...
            2024-08-06  1:54:31 0 [Note] Starting MariaDB 10.5.26-MariaDB-ubu2004 source revision 8b51d34462370b96af420587fdc07934abcea8ba server_uid 61e0Ds6VCA4znCHf3VZi8oKZ7jE= as process 1
             
            $ podman exec -ti mariadb mariadb -proot test
            Reading table information for completion of table and column names
            You can turn off this feature to get a quicker startup with -A
             
            Welcome to the MariaDB monitor.  Commands end with ; or \g.
            Your MariaDB connection id is 3
            Server version: 10.5.26-MariaDB-ubu2004 mariadb.org binary distribution
             
            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
             
            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
             
            MariaDB [test]> INSTALL SONAME 'type_mysql_json';
            Query OK, 0 rows affected (0.472 sec)
             
            MariaDB [test]> CHECK TABLE `jsonptntest`  FOR UPGRADE;
            +------------------+-------+----------+--------------------------------------------------+
            | Table            | Op    | Msg_type | Msg_text                                         |
            +------------------+-------+----------+--------------------------------------------------+
            | test.jsonptntest | check | Error    | Table 'test.jsonptntest' doesn't exist in engine |
            | test.jsonptntest | check | status   | Operation failed                                 |
            +------------------+-------+----------+--------------------------------------------------+
            2 rows in set (0.001 sec)
             
            MariaDB [test]> REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`;
            +------------------+--------+----------+--------------------------------------------------+
            | Table            | Op     | Msg_type | Msg_text                                         |
            +------------------+--------+----------+--------------------------------------------------+
            | test.jsonptntest | repair | Error    | Table 'test.jsonptntest' doesn't exist in engine |
            | test.jsonptntest | repair | status   | Operation failed                                 |
            +------------------+--------+----------+--------------------------------------------------+
            2 rows in set (0.001 sec)
             
            MariaDB [test]> UNINSTALL SONAME 'type_mysql_json'
                -> ;
            Query OK, 0 rows affected (0.011 sec)
             
            MariaDB [test]> CHECK TABLE `jsonptntest`  FOR UPGRADE;
            (container crashed)
            

            danblack Daniel Black added a comment - 11.4-5ab81ffe0097a22a774957df28c5223cf0201de3 Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000000000811143 in closefrm (table=table@entry=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table.cc:4770 4770 delete *ptr; [Current thread is 1 (Thread 0x7f1ae55696c0 (LWP 726382))] Missing separate debuginfos, use: dnf debuginfo-install glibc-2.39-17.fc40.x86_64 libcap-2.69-8.fc40.x86_64 libgcc-14.1.1-7.fc40.x86_64 libstdc++-14.1.1-7.fc40.x86_64 liburing-2.5-3.fc40.x86_64 libxcrypt-4.4.36-5.fc40.x86_64 libxml2-2.12.8-1.fc40.x86_64 libzstd-1.5.6-1.fc40.x86_64 openssl-libs-3.2.1-2.fc40.x86_64 pcre2-10.44-1.fc40.x86_64 systemd-libs-255.8-1.fc40.x86_64 xz-libs-5.4.6-3.fc40.x86_64 (gdb) p ptr $1 = (Field **) 0x7f1a7c2d61e8 (gdb) bt #0 0x0000000000811143 in closefrm (table=table@entry=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table.cc:4770 #1 0x00000000008f3734 in intern_close_table (table=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table_cache.cc:230 #2 tc_remove_table (table=0x7f1a7c3cfe88) at /home/dan/repos/mariadb-server-11.4/sql/table_cache.cc:268 #3 0x00000000006cac1b in close_thread_tables (thd=thd@entry=0x7f1a7c000c68) at /home/dan/repos/mariadb-server-11.4/sql/sql_base.cc:984 #4 0x000000000084e8dc in mysql_admin_table (thd=thd@entry=0x7f1a7c000c68, tables=tables@entry=0x7f1a7c032e38, check_opt=check_opt@entry=0x7f1a7c006240, operator_name=0xfd5bd0 <msg_check>, lock_type=lock_type@entry=TL_READ_NO_INSERT, org_open_for_modify=false, repair_table_use_frm=<optimized out>, extra_open_options=32, prepare_func=0x0, operator_func=(int (handler::*)(handler * const, THD *, HA_CHECK_OPT *)) 0x976820 <handler::ha_check(THD*, st_ha_check_opt*)>, view_operator_func=0x806830 <view_check(THD*, TABLE_LIST*, st_ha_check_opt*)>, is_cmd_replicated=<optimized out>) at /home/dan/repos/mariadb-server-11.4/sql/sql_admin.cc:1409 #5 0x000000000084fb6a in Sql_cmd_check_table::execute (this=<optimized out>, thd=0x7f1a7c000c68) at /home/dan/repos/mariadb-server-11.4/sql/sql_admin.cc:1592 #6 0x0000000000731d37 in mysql_execute_command (thd=thd@entry=0x7f1a7c000c68, is_called_from_prepared_stmt=false) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:5837 #7 0x000000000072ee25 in mysql_parse (thd=thd@entry=0x7f1a7c000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7f1ae5568530) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:7864 #8 0x000000000072d3b0 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x7f1a7c000c68, packet=packet@entry=0x7f1a7c007fc9 "", packet_length=packet_length@entry=38, blocking=true) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:1894 #9 0x000000000072f18f in do_command (thd=0x7f1a7c000c68, blocking=<optimized out>) at /home/dan/repos/mariadb-server-11.4/sql/sql_parse.cc:1407 #10 0x0000000000841eee in do_handle_one_connection (connect=<optimized out>, connect@entry=0x1a7d7a18, put_in_cache=true) at /home/dan/repos/mariadb-server-11.4/sql/sql_connect.cc:1439 #11 0x0000000000841d0b in handle_one_connection (arg=arg@entry=0x1a7d7a18) at /home/dan/repos/mariadb-server-11.4/sql/sql_connect.cc:1341 #12 0x0000000000b5680e in pfs_spawn_thread (arg=0x1a74ff28) at /home/dan/repos/mariadb-server-11.4/storage/perfschema/pfs.cc:2201 #13 0x00007f1ae7ea6507 in start_thread () from /lib64/libc.so.6 #14 0x00007f1ae7f2a40c in clone3 () from /lib64/libc.so.6 (gdb) p *ptr $2 = (Field *) 0x7f1a7c2d63e0 (gdb) p **ptr $3 = {<Value_source> = {<No data fields>}, _vptr$Field = 0x7f1ae88e46e8, ptr = 0x7f1a7c2d61b5 "", null_ptr = 0x7f1a7c2d61b0 "\377", table = 0x7f1a7c3cfe88, orig_table = 0x7f1a7c3cfe88, table_name = 0x7f1a7c3cff98, field_name = {str = 0x7f1a7c3a7714 "data", length = 4}, comment = {str = 0xf44561 "", length = 0}, option_list = 0x0, option_struct = 0x0, key_start = {buffer = {0}}, part_of_key = {buffer = {0}}, part_of_key_not_clustered = {buffer = {0}}, part_of_sortkey = {buffer = {0}}, unireg_check = 20, invisible = VISIBLE, field_length = 4294967295, flags = 144, field_index = 1, null_bit = 1 '\001', is_created_from_null_item = false, cond_selectivity = 1, next_equal_field = 0x0, read_stats = 0x0, collected_stats = 0x0, vcol_info = 0x0, check_constraint = 0x0, default_value = 0x0} (gdb) list 4765 table->expr_arena->free_items(); 4766 if (table->field) 4767 { 4768 for (Field **ptr=table->field ; *ptr ; ptr++) 4769 { 4770 delete *ptr; 4771 } 4772 table->field= 0; 4773 } 4774 delete table->file; (gdb) p *ptr->table $4 = {s = 0x7f1a7c2d7030, file = 0x7f1a7c2bf370, next = 0x0, prev = 0x7f1a7c03e280, share_all_next = 0x0, share_all_prev = 0x7f1a7c03e238, global_free_next = 0x7f1a7c02cdd8, global_free_prev = 0x1a0b78f8, instance = 0, in_use = 0x7f1a7c000c68, record = {0x7f1a7c2d61b0 "\377", 0x7f1a7c2d61c8 "", 0x7f1a7c2d61c8 ""}, write_row_record = 0x0, insert_values = 0x0, covering_keys = {buffer = {0}}, intersect_keys = { buffer = {0}}, keys_in_use_for_query = {buffer = {0}}, keys_in_use_for_group_by = {buffer = {0}}, keys_in_use_for_order_by = {buffer = {0}}, constraint_dependent_keys = {buffer = {0}}, key_info = 0x7f1a7c20acc0, Looking at sequence of sql emitted by mariadb-upgrade --force $ grep json /tmp/build-mariadb-server-11.4-datadir/bark.log 12 Query INSTALL SONAME 'type_mysql_json' DECLARE json_objects LONGTEXT; INTO json_objects CONCAT('"events": [', IFNULL(json_objects,''), ']') 16 Query CHECK TABLE `jsonptntest` FOR UPGRADE 16 Query REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest` 19 Query UNINSTALL SONAME 'type_mysql_json' DECLARE json_objects LONGTEXT; INTO json_objects CONCAT('"events": [', IFNULL(json_objects,''), ']') 30 Query CHECK TABLE `jsonptntest` FOR UPGRADE 10.5-8b51d34462370b96af420587fdc07934abcea8ba $ podman volume create m57; podman run --rm -v m57:/var/lib/mysql:Z -e MYSQL_ROOT_PASSWORD=root --name m57 -d mysql:5.7 m57 04417a270bb521a14048091353495fdb9357f5f62bd066d94ea3e8c3d6bbce48   $ podman exec -ti m57 mysql -proot mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 2 Server version: 5.7.44 MySQL Community Server (GPL)   Copyright (c) 2000, 2023, Oracle and/or its affiliates.   Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.   Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.   mysql> create database test; Query OK, 1 row affected (0.00 sec)   mysql> use test; Database changed mysql> CREATE TABLE `jsonptntest` ( -> `id` int(10) unsigned NOT NULL AUTO_INCREMENT, -> `data` json DEFAULT NULL, -> `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, -> PRIMARY KEY (`id`,`ts`), -> KEY `ts` (`ts`) -> ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=latin1 -> /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts)) -> (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = InnoDB, -> PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = InnoDB, -> PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = InnoDB, -> PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = InnoDB, -> PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = InnoDB) */; Query OK, 0 rows affected (0.05 sec)   mysql> shutdown; Query OK, 0 rows affected (0.00 sec)   $ podman run --rm -v m57:/var/lib/mysql:Z --name mariadb -d quay.io/mariadb-foundation/mariadb-devel:earliest 8c3e923f123a6d0dd8402133bdf2d26702a54c734815756331e798207cc969e8   $ podman logs mariadb 2024-08-06 01:54:28+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.5.26+maria~ubu2004 started. 2024-08-06 01:54:30+00:00 [Note] [Entrypoint]: Switching to dedicated user 'mysql' 2024-08-06 01:54:30+00:00 [Note] [Entrypoint]: Entrypoint script for MariaDB Server 1:10.5.26+maria~ubu2004 started. 2024-08-06 01:54:31+00:00 [Note] [Entrypoint]: MariaDB upgrade information missing, assuming required ... 2024-08-06 1:54:31 0 [Note] Starting MariaDB 10.5.26-MariaDB-ubu2004 source revision 8b51d34462370b96af420587fdc07934abcea8ba server_uid 61e0Ds6VCA4znCHf3VZi8oKZ7jE= as process 1   $ podman exec -ti mariadb mariadb -proot test Reading table information for completion of table and column names You can turn off this feature to get a quicker startup with -A   Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 3 Server version: 10.5.26-MariaDB-ubu2004 mariadb.org binary distribution   Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.   Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.   MariaDB [test]> INSTALL SONAME 'type_mysql_json'; Query OK, 0 rows affected (0.472 sec)   MariaDB [test]> CHECK TABLE `jsonptntest` FOR UPGRADE; +------------------+-------+----------+--------------------------------------------------+ | Table | Op | Msg_type | Msg_text | +------------------+-------+----------+--------------------------------------------------+ | test.jsonptntest | check | Error | Table 'test.jsonptntest' doesn't exist in engine | | test.jsonptntest | check | status | Operation failed | +------------------+-------+----------+--------------------------------------------------+ 2 rows in set (0.001 sec)   MariaDB [test]> REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`; +------------------+--------+----------+--------------------------------------------------+ | Table | Op | Msg_type | Msg_text | +------------------+--------+----------+--------------------------------------------------+ | test.jsonptntest | repair | Error | Table 'test.jsonptntest' doesn't exist in engine | | test.jsonptntest | repair | status | Operation failed | +------------------+--------+----------+--------------------------------------------------+ 2 rows in set (0.001 sec)   MariaDB [test]> UNINSTALL SONAME 'type_mysql_json' -> ; Query OK, 0 rows affected (0.011 sec)   MariaDB [test]> CHECK TABLE `jsonptntest` FOR UPGRADE; (container crashed)
            danblack Daniel Black added a comment -

            Succeeds for MyISAM:

            5.7 create table

            $ podman volume create m57; podman run --rm -v m57:/var/lib/mysql:Z -e MYSQL_ROOT_PASSWORD=root --name m57 -d mysql:5.7
            m57
            59c1ea3d681f266d405cbf7fc49ce434e3de9b37c7e23cb7a80e29dc53dd7488
             
            $ podman exec -ti m57 mysql -proot
            mysql: [Warning] Using a password on the command line interface can be insecure.
            Welcome to the MySQL monitor.  Commands end with ; or \g.
            Your MySQL connection id is 2
            Server version: 5.7.44 MySQL Community Server (GPL)
             
            Copyright (c) 2000, 2023, Oracle and/or its affiliates.
             
            Oracle is a registered trademark of Oracle Corporation and/or its
            affiliates. Other names may be trademarks of their respective
            owners.
             
            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
             
            mysql> create database test;
            Query OK, 1 row affected (0.00 sec)
             
            mysql> CREATE TABLE `jsonptntest` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `data` json DEFAULT NULL, `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, PRIMARY KEY (`id`,`ts`), KEY
            `ts` (`ts`) ) ENGINE=MyISAM;
            Query OK, 0 rows affected (0.43 sec)
             
            mysql> shutdown
                -> ;
            Query OK, 0 rows affected (0.00 sec)
            
            

            Server version: 10.5.26-MariaDB-ubu2004 mariadb.org binary distribution
             
            Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
             
            Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
             
            MariaDB [test]>  INSTALL SONAME 'type_mysql_json';
            Query OK, 0 rows affected (0.472 sec)
             
            MariaDB [test]> use test;
            Database changed
            MariaDB [test]> show tables
                -> ;
            +----------------+
            | Tables_in_test |
            +----------------+
            | jsonptntest    |
            +----------------+
            1 row in set (0.001 sec)
             
            MariaDB [test]> show create table jsonptntest ;
            ERROR 1707 (HY000): Table rebuild required. Please do "ALTER TABLE `test.jsonptntest` FORCE" or dump/reload to fix it!
            MariaDB [test]>  CHECK TABLE `jsonptntest`  FOR UPGRADE;
            +------------------+-------+----------+------------------------------------------------------------------------------------+
            | Table            | Op    | Msg_type | Msg_text                                                                           |
            +------------------+-------+----------+------------------------------------------------------------------------------------+
            | test.jsonptntest | check | error    | Upgrade required. Please do "REPAIR TABLE `jsonptntest`" or dump/reload to fix it! |
            +------------------+-------+----------+------------------------------------------------------------------------------------+
            1 row in set (0.001 sec)
             
            MariaDB [test]> REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`;
            +------------------+--------+----------+----------+
            | Table            | Op     | Msg_type | Msg_text |
            +------------------+--------+----------+----------+
            | test.jsonptntest | repair | status   | OK       |
            +------------------+--------+----------+----------+
            1 row in set (0.476 sec)
             
            MariaDB [test]> UNINSTALL SONAME 'type_mysql_json';
            Query OK, 0 rows affected (0.471 sec)              
             
            MariaDB [test]> CHECK TABLE `jsonptntest`  FOR UPGRADE;
            +------------------+-------+----------+----------+
            | Table            | Op    | Msg_type | Msg_text |
            +------------------+-------+----------+----------+
            | test.jsonptntest | check | status   | OK       |
            +------------------+-------+----------+----------+
            1 row in set (0.001 sec)
             
            MariaDB [test]> select * from jsonptntest;
            Empty set (0.001 sec)
            

            So problems:

            • InnoDB fails to recognise with partitionsTable 'test.jsonptntest' doesn't exist in engine ( {CREATE TABLE `jsonptntest` (`data` json DEFAULT NULL ) ENGINE=InnoDB ;}

              worked however).

            • There is incorrect cleanup after REPAIR TABLE failure and Table status was left if a bad state causing CHECK TABLE FOR UPGRADE to crash as the next command.

            The same crash also occurred with MyISAM as the table type as follows:

            5.7 table

            CREATE TABLE `jsonptntest` (
              `id` int(10) unsigned NOT NULL AUTO_INCREMENT,
              `data` json DEFAULT NULL,
              `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
              PRIMARY KEY (`id`,`ts`),
              KEY `ts` (`ts`)
            ) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=latin1
            /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts))
            (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = MyISAM,
             PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = MyISAM,
             PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = MyISAM,
             PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = MyISAM,
             PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = MyISAM) */
            

            10.5.26-8b51d34462370b96af420587fdc07934abcea8ba processing

            MariaDB [test]> INSTALL SONAME 'type_mysql_json';
            Query OK, 0 rows affected (0.011 sec)
             
            MariaDB [test]> show create table jsonptntest\G
            ERROR 1707 (HY000): Table rebuild required. Please do "ALTER TABLE `test.jsonptntest` FORCE" or dump/reload to fix it!
            MariaDB [test]>  REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`;
            +------------------+--------+----------+---------------------------------------------------------------------------------+
            | Table            | Op     | Msg_type | Msg_text                                                                        |
            +------------------+--------+----------+---------------------------------------------------------------------------------+
            | test.jsonptntest | repair | Error    | The mix of handlers in the partitions is not allowed in this version of MariaDB |
            | test.jsonptntest | repair | status   | Operation failed                                                                |
            +------------------+--------+----------+---------------------------------------------------------------------------------+
            2 rows in set (0.002 sec)
             
            MariaDB [test]>  UNINSTALL SONAME 'type_mysql_json';
             Query OK, 0 rows affected (0.473 sec)
             
            MariaDB [test]>  CHECK TABLE `jsonptntest`  FOR UPGRADE;
            (crash)
            /lib/x86_64-linux-gnu/libpthread.so.0(+0x14420)[0x7f6ee1a15420]
            mysqld(_Z8closefrmP5TABLE+0x87)[0x55ad7534be17]
            mysqld(+0x974426)[0x55ad75437426]
            mysqld(_Z16tc_release_tableP5TABLE+0x8a)[0x55ad7543789a]
            mysqld(_Z18close_thread_tableP3THDPP5TABLE+0xe6)[0x55ad751fe096]
            mysqld(_Z19close_thread_tablesP3THD+0x1db)[0x55ad751fe2db]
            mysqld(+0x8d2244)[0x55ad75395244]
            mysqld(_ZN19Sql_cmd_check_table7executeEP3THD+0x8a)[0x55ad7539774a]
            mysqld(_Z21mysql_execute_commandP3THD+0x1136)[0x55ad75278146]
            mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x21f)[0x55ad752663bf]
            mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x13c5)[0x55ad752739e5]
            mysqld(_Z10do_commandP3THD+0x123)[0x55ad752762a3]
            mysqld(_Z24do_handle_one_connectionP7CONNECTb+0x421)[0x55ad75387ef1]
            mysqld(handle_one_connection+0x5d)[0x55ad7538836d]
            mysqld(+0xc685ff)[0x55ad7572b5ff]
            /lib/x86_64-linux-gnu/libpthread.so.0(+0x8609)[0x7f6ee1a09609]
            /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f6ee15f5353]
            

            danblack Daniel Black added a comment - Succeeds for MyISAM: 5.7 create table $ podman volume create m57; podman run --rm -v m57:/var/lib/mysql:Z -e MYSQL_ROOT_PASSWORD=root --name m57 -d mysql:5.7 m57 59c1ea3d681f266d405cbf7fc49ce434e3de9b37c7e23cb7a80e29dc53dd7488   $ podman exec -ti m57 mysql -proot mysql: [Warning] Using a password on the command line interface can be insecure. Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 2 Server version: 5.7.44 MySQL Community Server (GPL)   Copyright (c) 2000, 2023, Oracle and/or its affiliates.   Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.   Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.   mysql> create database test; Query OK, 1 row affected (0.00 sec)   mysql> CREATE TABLE `jsonptntest` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `data` json DEFAULT NULL, `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, PRIMARY KEY (`id`,`ts`), KEY `ts` (`ts`) ) ENGINE=MyISAM; Query OK, 0 rows affected (0.43 sec)   mysql> shutdown -> ; Query OK, 0 rows affected (0.00 sec) Server version: 10.5.26-MariaDB-ubu2004 mariadb.org binary distribution   Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.   Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.   MariaDB [test]> INSTALL SONAME 'type_mysql_json'; Query OK, 0 rows affected (0.472 sec)   MariaDB [test]> use test; Database changed MariaDB [test]> show tables -> ; +----------------+ | Tables_in_test | +----------------+ | jsonptntest | +----------------+ 1 row in set (0.001 sec)   MariaDB [test]> show create table jsonptntest ; ERROR 1707 (HY000): Table rebuild required. Please do "ALTER TABLE `test.jsonptntest` FORCE" or dump/reload to fix it! MariaDB [test]> CHECK TABLE `jsonptntest` FOR UPGRADE; +------------------+-------+----------+------------------------------------------------------------------------------------+ | Table | Op | Msg_type | Msg_text | +------------------+-------+----------+------------------------------------------------------------------------------------+ | test.jsonptntest | check | error | Upgrade required. Please do "REPAIR TABLE `jsonptntest`" or dump/reload to fix it! | +------------------+-------+----------+------------------------------------------------------------------------------------+ 1 row in set (0.001 sec)   MariaDB [test]> REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`; +------------------+--------+----------+----------+ | Table | Op | Msg_type | Msg_text | +------------------+--------+----------+----------+ | test.jsonptntest | repair | status | OK | +------------------+--------+----------+----------+ 1 row in set (0.476 sec)   MariaDB [test]> UNINSTALL SONAME 'type_mysql_json'; Query OK, 0 rows affected (0.471 sec)   MariaDB [test]> CHECK TABLE `jsonptntest` FOR UPGRADE; +------------------+-------+----------+----------+ | Table | Op | Msg_type | Msg_text | +------------------+-------+----------+----------+ | test.jsonptntest | check | status | OK | +------------------+-------+----------+----------+ 1 row in set (0.001 sec)   MariaDB [test]> select * from jsonptntest; Empty set (0.001 sec) So problems: InnoDB fails to recognise with partitionsTable 'test.jsonptntest' doesn't exist in engine ( {CREATE TABLE `jsonptntest` (`data` json DEFAULT NULL ) ENGINE=InnoDB ;} worked however). There is incorrect cleanup after REPAIR TABLE failure and Table status was left if a bad state causing CHECK TABLE FOR UPGRADE to crash as the next command. The same crash also occurred with MyISAM as the table type as follows: 5.7 table CREATE TABLE `jsonptntest` ( `id` int(10) unsigned NOT NULL AUTO_INCREMENT, `data` json DEFAULT NULL, `ts` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP, PRIMARY KEY (`id`,`ts`), KEY `ts` (`ts`) ) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=latin1 /*!50100 PARTITION BY RANGE ( UNIX_TIMESTAMP(ts)) (PARTITION p_2021 VALUES LESS THAN (1640991600) ENGINE = MyISAM, PARTITION p_2022 VALUES LESS THAN (1672527600) ENGINE = MyISAM, PARTITION p_2023 VALUES LESS THAN (1704063600) ENGINE = MyISAM, PARTITION p_2024 VALUES LESS THAN (1735686000) ENGINE = MyISAM, PARTITION p_max VALUES LESS THAN MAXVALUE ENGINE = MyISAM) */ 10.5.26-8b51d34462370b96af420587fdc07934abcea8ba processing MariaDB [test]> INSTALL SONAME 'type_mysql_json'; Query OK, 0 rows affected (0.011 sec)   MariaDB [test]> show create table jsonptntest\G ERROR 1707 (HY000): Table rebuild required. Please do "ALTER TABLE `test.jsonptntest` FORCE" or dump/reload to fix it! MariaDB [test]> REPAIR NO_WRITE_TO_BINLOG TABLE `test`.`jsonptntest`; +------------------+--------+----------+---------------------------------------------------------------------------------+ | Table | Op | Msg_type | Msg_text | +------------------+--------+----------+---------------------------------------------------------------------------------+ | test.jsonptntest | repair | Error | The mix of handlers in the partitions is not allowed in this version of MariaDB | | test.jsonptntest | repair | status | Operation failed | +------------------+--------+----------+---------------------------------------------------------------------------------+ 2 rows in set (0.002 sec)   MariaDB [test]> UNINSTALL SONAME 'type_mysql_json'; Query OK, 0 rows affected (0.473 sec)   MariaDB [test]> CHECK TABLE `jsonptntest` FOR UPGRADE; (crash) /lib/x86_64-linux-gnu/libpthread.so.0(+0x14420)[0x7f6ee1a15420] mysqld(_Z8closefrmP5TABLE+0x87)[0x55ad7534be17] mysqld(+0x974426)[0x55ad75437426] mysqld(_Z16tc_release_tableP5TABLE+0x8a)[0x55ad7543789a] mysqld(_Z18close_thread_tableP3THDPP5TABLE+0xe6)[0x55ad751fe096] mysqld(_Z19close_thread_tablesP3THD+0x1db)[0x55ad751fe2db] mysqld(+0x8d2244)[0x55ad75395244] mysqld(_ZN19Sql_cmd_check_table7executeEP3THD+0x8a)[0x55ad7539774a] mysqld(_Z21mysql_execute_commandP3THD+0x1136)[0x55ad75278146] mysqld(_Z11mysql_parseP3THDPcjP12Parser_statebb+0x21f)[0x55ad752663bf] mysqld(_Z16dispatch_command19enum_server_commandP3THDPcjbb+0x13c5)[0x55ad752739e5] mysqld(_Z10do_commandP3THD+0x123)[0x55ad752762a3] mysqld(_Z24do_handle_one_connectionP7CONNECTb+0x421)[0x55ad75387ef1] mysqld(handle_one_connection+0x5d)[0x55ad7538836d] mysqld(+0xc685ff)[0x55ad7572b5ff] /lib/x86_64-linux-gnu/libpthread.so.0(+0x8609)[0x7f6ee1a09609] /lib/x86_64-linux-gnu/libc.so.6(clone+0x43)[0x7f6ee15f5353]
            alice Alice Sherepa added a comment - - edited

            shorter table, to get rid of timestamp. (attached datadir with it from mysql 5.7.44)

            CREATE TABLE t1 ( i int, d json)  partition BY key(i) partitions 2;
            

            10.5.26-MariaDB-debug source revision 8b51d34462370b96af420587fdc07934abcea8ba 
            2024-08-06 10:05:31 39 [ERROR] mysqld: Table rebuild required. Please do "ALTER TABLE `test.t1` FORCE" or dump/reload to fix it!
            =================================================================
            ==3027582==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fc742ab8d78 at pc 0x5566be40e802 bp 0x7fc73ba96500 sp 0x7fc73ba964f0
            READ of size 8 at 0x7fc742ab8d78 thread T26
                #0 0x5566be40e801 in closefrm(TABLE*) /10.5/src/sql/table.cc:4431
                #1 0x5566be7525dd in intern_close_table /10.5/src/sql/table_cache.cc:220
                #2 0x5566be752844 in tc_remove_table /10.5/src/sql/table_cache.cc:258
                #3 0x5566be753d16 in tc_release_table(TABLE*) /10.5/src/sql/table_cache.cc:451
                #4 0x5566bdee94d6 in close_thread_table(THD*, TABLE**) /10.5/src/sql/sql_base.cc:998
                #5 0x5566bdee8b00 in close_thread_tables(THD*) /10.5/src/sql/sql_base.cc:938
                #6 0x5566be5337e3 in mysql_admin_table /10.5/src/sql/sql_admin.cc:1324
                #7 0x5566be534f73 in Sql_cmd_check_table::execute(THD*) /10.5/src/sql/sql_admin.cc:1490
                #8 0x5566be0ace50 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:6173
                #9 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229
                #10 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892
                #11 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376
                #12 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417
                #13 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319
                #14 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201
                #15 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477
                #16 0x7fc767652352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352)
             
            0x7fc742ab8d78 is located 111992 bytes inside of 137508-byte region [0x7fc742a9d800,0x7fc742abf124)
            freed by thread T26 here:
                #0 0x7fc76809e40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
                #1 0x5566bfe33fa8 in free_memory /10.5/src/mysys/safemalloc.c:280
                #2 0x5566bfe33564 in sf_free /10.5/src/mysys/safemalloc.c:198
                #3 0x5566bfe01c27 in my_free /10.5/src/mysys/my_malloc.c:213
                #4 0x5566bf356fa0 in hp_free_level /10.5/src/storage/heap/hp_block.c:151
                #5 0x5566bf357152 in hp_clear /10.5/src/storage/heap/hp_clear.c:35
                #6 0x5566bf35b6fe in hp_free /10.5/src/storage/heap/hp_create.c:364
                #7 0x5566bf3584b9 in hp_close /10.5/src/storage/heap/hp_close.c:42
                #8 0x5566bf339ee6 in ha_heap::close() /10.5/src/storage/heap/ha_heap.cc:140
                #9 0x5566be91a9b2 in handler::ha_close() /10.5/src/sql/handler.cc:3173
                #10 0x5566bf33cfaf in ha_heap::drop_table(char const*) /10.5/src/storage/heap/ha_heap.cc:553
                #11 0x5566be92ecba in handler::ha_drop_table(char const*) /10.5/src/sql/handler.cc:5162
                #12 0x5566be1ee62b in free_tmp_table(THD*, TABLE*) /10.5/src/sql/sql_select.cc:20537
                #13 0x5566bdee8637 in close_thread_tables(THD*) /10.5/src/sql/sql_base.cc:857
                #14 0x5566be0ad719 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:6239
                #15 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229
                #16 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892
                #17 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376
                #18 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417
                #19 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319
                #20 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201
                #21 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477
             
            previously allocated by thread T26 here:
                #0 0x7fc76809e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
                #1 0x5566bfe32f18 in sf_malloc /10.5/src/mysys/safemalloc.c:121
                #2 0x5566bfe00e01 in my_malloc /10.5/src/mysys/my_malloc.c:91
                #3 0x5566bf3568ee in hp_get_new_block /10.5/src/storage/heap/hp_block.c:81
                #4 0x5566bf354b03 in next_free_record_pos /10.5/src/storage/heap/hp_write.c:163
                #5 0x5566bf3535c9 in heap_write /10.5/src/storage/heap/hp_write.c:45
                #6 0x5566bf33ab36 in ha_heap::write_row(unsigned char const*) /10.5/src/storage/heap/ha_heap.cc:239
                #7 0x5566be244f88 in handler::ha_write_tmp_row(unsigned char*) /10.5/src/sql/sql_class.h:7303
                #8 0x5566be277851 in schema_table_store_record(THD*, TABLE*) /10.5/src/sql/sql_show.cc:3907
                #9 0x5566be2770dc in show_status_array /10.5/src/sql/sql_show.cc:3828
                #10 0x5566be2ab52b in fill_variables(THD*, TABLE_LIST*, Item*) /10.5/src/sql/sql_show.cc:8033
                #11 0x5566be2b5932 in get_schema_tables_result(JOIN*, enum_schema_table_state) /10.5/src/sql/sql_show.cc:9012
                #12 0x5566be17985f in JOIN::exec_inner() /10.5/src/sql/sql_select.cc:4614
                #13 0x5566be177725 in JOIN::exec() /10.5/src/sql/sql_select.cc:4437
                #14 0x5566be17bb66 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.5/src/sql/sql_select.cc:4914
                #15 0x5566be14bf1a in handle_select(THD*, LEX*, select_result*, unsigned long) /10.5/src/sql/sql_select.cc:449
                #16 0x5566be0af431 in execute_sqlcom_select /10.5/src/sql/sql_parse.cc:6431
                #17 0x5566be09d9a7 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:4030
                #18 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229
                #19 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892
                #20 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376
                #21 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417
                #22 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319
                #23 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201
                #24 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477
             
            Thread T26 created by T0 here:
                #0 0x7fc767fcb815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208
                #1 0x5566bf179c4c in my_thread_create /10.5/src/storage/perfschema/my_thread.h:52
                #2 0x5566bf17e46a in pfs_spawn_thread_v1 /10.5/src/storage/perfschema/pfs.cc:2252
                #3 0x5566bdd68b9c in inline_mysql_thread_create /10.5/src/include/mysql/psi/mysql_thread.h:1323
                #4 0x5566bdd7f72a in create_thread_to_handle_connection(CONNECT*) /10.5/src/sql/mysqld.cc:6111
                #5 0x5566bdd7fda9 in create_new_thread(CONNECT*) /10.5/src/sql/mysqld.cc:6170
                #6 0x5566bdd80106 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/src/sql/mysqld.cc:6235
                #7 0x5566bdd80d68 in handle_connections_sockets() /10.5/src/sql/mysqld.cc:6362
                #8 0x5566bdd7ef37 in mysqld_main(int, char**) /10.5/src/sql/mysqld.cc:5757
                #9 0x5566bdd671bc in main /10.5/src/sql/main.cc:25
                #10 0x7fc767557082 in __libc_start_main ../csu/libc-start.c:308
             
            SUMMARY: AddressSanitizer: heap-use-after-free /10.5/src/sql/table.cc:4431 in closefrm(TABLE*)
            Shadow bytes around the buggy address:
              0x0ff96854f150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
            =>0x0ff96854f1a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd]
              0x0ff96854f1b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f1c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f1d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f1e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
              0x0ff96854f1f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
            Shadow byte legend (one shadow byte represents 8 application bytes):
              Addressable:           00
              Partially addressable: 01 02 03 04 05 06 07 
              Heap left redzone:       fa
              Freed heap region:       fd
              Stack left redzone:      f1
              Stack mid redzone:       f2
              Stack right redzone:     f3
              Stack after return:      f5
              Stack use after scope:   f8
              Global redzone:          f9
              Global init order:       f6
              Poisoned by user:        f7
              Container overflow:      fc
              Array cookie:            ac
              Intra object redzone:    bb
              ASan internal:           fe
              Left alloca redzone:     ca
              Right alloca redzone:    cb
              Shadow gap:              cc
            ==3027582==ABORTING
            

            alice Alice Sherepa added a comment - - edited shorter table, to get rid of timestamp. (attached datadir with it from mysql 5.7.44) CREATE TABLE t1 ( i int, d json) partition BY key(i) partitions 2; 10.5.26-MariaDB-debug source revision 8b51d34462370b96af420587fdc07934abcea8ba 2024-08-06 10:05:31 39 [ERROR] mysqld: Table rebuild required. Please do "ALTER TABLE `test.t1` FORCE" or dump/reload to fix it! ================================================================= ==3027582==ERROR: AddressSanitizer: heap-use-after-free on address 0x7fc742ab8d78 at pc 0x5566be40e802 bp 0x7fc73ba96500 sp 0x7fc73ba964f0 READ of size 8 at 0x7fc742ab8d78 thread T26 #0 0x5566be40e801 in closefrm(TABLE*) /10.5/src/sql/table.cc:4431 #1 0x5566be7525dd in intern_close_table /10.5/src/sql/table_cache.cc:220 #2 0x5566be752844 in tc_remove_table /10.5/src/sql/table_cache.cc:258 #3 0x5566be753d16 in tc_release_table(TABLE*) /10.5/src/sql/table_cache.cc:451 #4 0x5566bdee94d6 in close_thread_table(THD*, TABLE**) /10.5/src/sql/sql_base.cc:998 #5 0x5566bdee8b00 in close_thread_tables(THD*) /10.5/src/sql/sql_base.cc:938 #6 0x5566be5337e3 in mysql_admin_table /10.5/src/sql/sql_admin.cc:1324 #7 0x5566be534f73 in Sql_cmd_check_table::execute(THD*) /10.5/src/sql/sql_admin.cc:1490 #8 0x5566be0ace50 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:6173 #9 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229 #10 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892 #11 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376 #12 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417 #13 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319 #14 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201 #15 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477 #16 0x7fc767652352 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11f352)   0x7fc742ab8d78 is located 111992 bytes inside of 137508-byte region [0x7fc742a9d800,0x7fc742abf124) freed by thread T26 here: #0 0x7fc76809e40f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122 #1 0x5566bfe33fa8 in free_memory /10.5/src/mysys/safemalloc.c:280 #2 0x5566bfe33564 in sf_free /10.5/src/mysys/safemalloc.c:198 #3 0x5566bfe01c27 in my_free /10.5/src/mysys/my_malloc.c:213 #4 0x5566bf356fa0 in hp_free_level /10.5/src/storage/heap/hp_block.c:151 #5 0x5566bf357152 in hp_clear /10.5/src/storage/heap/hp_clear.c:35 #6 0x5566bf35b6fe in hp_free /10.5/src/storage/heap/hp_create.c:364 #7 0x5566bf3584b9 in hp_close /10.5/src/storage/heap/hp_close.c:42 #8 0x5566bf339ee6 in ha_heap::close() /10.5/src/storage/heap/ha_heap.cc:140 #9 0x5566be91a9b2 in handler::ha_close() /10.5/src/sql/handler.cc:3173 #10 0x5566bf33cfaf in ha_heap::drop_table(char const*) /10.5/src/storage/heap/ha_heap.cc:553 #11 0x5566be92ecba in handler::ha_drop_table(char const*) /10.5/src/sql/handler.cc:5162 #12 0x5566be1ee62b in free_tmp_table(THD*, TABLE*) /10.5/src/sql/sql_select.cc:20537 #13 0x5566bdee8637 in close_thread_tables(THD*) /10.5/src/sql/sql_base.cc:857 #14 0x5566be0ad719 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:6239 #15 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229 #16 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892 #17 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376 #18 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417 #19 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319 #20 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201 #21 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477   previously allocated by thread T26 here: #0 0x7fc76809e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 #1 0x5566bfe32f18 in sf_malloc /10.5/src/mysys/safemalloc.c:121 #2 0x5566bfe00e01 in my_malloc /10.5/src/mysys/my_malloc.c:91 #3 0x5566bf3568ee in hp_get_new_block /10.5/src/storage/heap/hp_block.c:81 #4 0x5566bf354b03 in next_free_record_pos /10.5/src/storage/heap/hp_write.c:163 #5 0x5566bf3535c9 in heap_write /10.5/src/storage/heap/hp_write.c:45 #6 0x5566bf33ab36 in ha_heap::write_row(unsigned char const*) /10.5/src/storage/heap/ha_heap.cc:239 #7 0x5566be244f88 in handler::ha_write_tmp_row(unsigned char*) /10.5/src/sql/sql_class.h:7303 #8 0x5566be277851 in schema_table_store_record(THD*, TABLE*) /10.5/src/sql/sql_show.cc:3907 #9 0x5566be2770dc in show_status_array /10.5/src/sql/sql_show.cc:3828 #10 0x5566be2ab52b in fill_variables(THD*, TABLE_LIST*, Item*) /10.5/src/sql/sql_show.cc:8033 #11 0x5566be2b5932 in get_schema_tables_result(JOIN*, enum_schema_table_state) /10.5/src/sql/sql_show.cc:9012 #12 0x5566be17985f in JOIN::exec_inner() /10.5/src/sql/sql_select.cc:4614 #13 0x5566be177725 in JOIN::exec() /10.5/src/sql/sql_select.cc:4437 #14 0x5566be17bb66 in mysql_select(THD*, TABLE_LIST*, List<Item>&, Item*, unsigned int, st_order*, st_order*, Item*, st_order*, unsigned long long, select_result*, st_select_lex_unit*, st_select_lex*) /10.5/src/sql/sql_select.cc:4914 #15 0x5566be14bf1a in handle_select(THD*, LEX*, select_result*, unsigned long) /10.5/src/sql/sql_select.cc:449 #16 0x5566be0af431 in execute_sqlcom_select /10.5/src/sql/sql_parse.cc:6431 #17 0x5566be09d9a7 in mysql_execute_command(THD*) /10.5/src/sql/sql_parse.cc:4030 #18 0x5566be0ba5da in mysql_parse(THD*, char*, unsigned int, Parser_state*, bool, bool) /10.5/src/sql/sql_parse.cc:8229 #19 0x5566be08f7da in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool, bool) /10.5/src/sql/sql_parse.cc:1892 #20 0x5566be08c142 in do_command(THD*) /10.5/src/sql/sql_parse.cc:1376 #21 0x5566be4f38e5 in do_handle_one_connection(CONNECT*, bool) /10.5/src/sql/sql_connect.cc:1417 #22 0x5566be4f3249 in handle_one_connection /10.5/src/sql/sql_connect.cc:1319 #23 0x5566bf17e077 in pfs_spawn_thread /10.5/src/storage/perfschema/pfs.cc:2201 #24 0x7fc767a81608 in start_thread /build/glibc-LcI20x/glibc-2.31/nptl/pthread_create.c:477   Thread T26 created by T0 here: #0 0x7fc767fcb815 in __interceptor_pthread_create ../../../../src/libsanitizer/asan/asan_interceptors.cc:208 #1 0x5566bf179c4c in my_thread_create /10.5/src/storage/perfschema/my_thread.h:52 #2 0x5566bf17e46a in pfs_spawn_thread_v1 /10.5/src/storage/perfschema/pfs.cc:2252 #3 0x5566bdd68b9c in inline_mysql_thread_create /10.5/src/include/mysql/psi/mysql_thread.h:1323 #4 0x5566bdd7f72a in create_thread_to_handle_connection(CONNECT*) /10.5/src/sql/mysqld.cc:6111 #5 0x5566bdd7fda9 in create_new_thread(CONNECT*) /10.5/src/sql/mysqld.cc:6170 #6 0x5566bdd80106 in handle_accepted_socket(st_mysql_socket, st_mysql_socket) /10.5/src/sql/mysqld.cc:6235 #7 0x5566bdd80d68 in handle_connections_sockets() /10.5/src/sql/mysqld.cc:6362 #8 0x5566bdd7ef37 in mysqld_main(int, char**) /10.5/src/sql/mysqld.cc:5757 #9 0x5566bdd671bc in main /10.5/src/sql/main.cc:25 #10 0x7fc767557082 in __libc_start_main ../csu/libc-start.c:308   SUMMARY: AddressSanitizer: heap-use-after-free /10.5/src/sql/table.cc:4431 in closefrm(TABLE*) Shadow bytes around the buggy address: 0x0ff96854f150: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f160: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f170: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f180: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f190: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0ff96854f1a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd[fd] 0x0ff96854f1b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f1c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f1d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f1e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0ff96854f1f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==3027582==ABORTING

            People

              Unassigned Unassigned
              oli Oli Sennhauser
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.