MDEV-33197SIGSEGV and UBSAN member access [within/on] null pointer in spider_db_get_row_from_tmp_tbl, Assertion in spider_db_errorno and SIGSEGV in spider_db_store_result
#6 0x000014e69b83b507 in __assert_fail (assertion=0x55df17168778 "thd->status_var.tmp_space_used >= track->previous_file_size", file=0x55df1732a767 "/test/11.5_dbg/sql/mysqld.cc", line=3824, function=0x55df17168740 "int temp_file_size_cb_func(tmp_file_tracking*, int)") at ./assert/assert.c:103
#7 0x000055df162f0b05 in temp_file_size_cb_func (track=0x14e698747000, no_error=0) at /test/11.5_dbg/sql/mysqld.cc:3824
#8 0x000055df169639bd in _ma_update_tmp_file_size (track=<optimized out>, file_size=<optimized out>) at /test/11.5_dbg/storage/maria/ma_info.c:234
#9 0x000055df16970bc6 in ha_maria::drop_table (this=0x14e624029860, name=0x14e624018fa8 "/test/MD130824-mariadb-11.5.2-linux-x86_64-dbg/data/#sql-temptable-26593-8-0") at /test/11.5_dbg/storage/maria/ha_maria.cc:2939
#10 0x000055df164a0717 in free_tmp_table (thd=0x14e624000f98, entry=0x14e624018160) at /test/11.5_dbg/sql/sql_select.cc:22903
#11 0x000014e69811fbaf in spider_rm_sys_tmp_table_for_result (thd=<optimized out>, tmp_table=<optimized out>, tmp_tbl_prm=tmp_tbl_prm@entry=0x14e6240173f0)at /test/11.5_dbg/storage/spider/spd_sys_table.cc:3156
#12 0x000014e69812da01 in spider_db_free_one_result (result_list=result_list@entry=0x14e63c0e0250, result=0x14e6240173a8)at /test/11.5_dbg/storage/spider/spd_db_conn.cc:2824
#13 0x000014e6981322d2 in spider_db_seek_next (buf=0x14e63c0a43e0 "\377", spider=0x14e63c0dfc50, link_idx=0, table=0x14e63c0a3460)at /test/11.5_dbg/storage/spider/spd_db_conn.cc:4006
#14 0x000014e6981c4927 in spider_group_by_handler::next_row (this=0x14e63c37de70)at /test/11.5_dbg/storage/spider/spd_group_by_handler.cc:1369
#15 0x000055df164f949f in Pushdown_query::execute (this=0x14e63c01e930, join=join@entry=0x14e63c01c240)at /test/11.5_dbg/sql/group_by_handler.cc:64
#16 0x000055df164c735c in do_select (procedure=<optimized out>, join=0x14e63c01c240) at /test/11.5_dbg/sql/sql_select.cc:23058
Roel Van de Paar
added a comment - - edited Discussed w/ ycp and tested against bb-11.5-mdev-34518. It still asserts there.
bb-11.5-mdev-34518 11.5.2 b8dec55ca7b10235d5592d15eac775eed3cbd2f1 (Debug)
#5 0x00001510a002881b in __assert_fail_base (fmt=0x1510a01d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55d9ef6be6e8 "thd->status_var.tmp_space_used >= track->previous_file_size", file=file@entry=0x55d9ef6be080 "/test/bb-11.5-mdev-34518_dbg/sql/mysqld.cc", line=line@entry=3793, function=function@entry=0x55d9ef6be6b0 "int temp_file_size_cb_func(tmp_file_tracking*, int)") at ./assert/assert.c:94
debug_assert_on_not_freed_memory is just a switch that allows auto assertion failure on nonzero status_var.local_memory_used.
safemalloc warnings look like it could be a hint:
Warning: 3624 bytes freed by T@4, allocated by T@9 at 0x5624a8732661, mysys/my_malloc.c:91, mysys/my_alloc.c:244, sql/sql_select.cc:18953, sql/sql_select.cc:19794, spider/spd_sys_table.cc:3095, spider/spd_db_conn.cc:4004, spider/spd_conn.cc:2787
which points to an if branch in spider_db_store_result(), called from a bg thread in spider_bg_conn_action(). The branch is entered
if (
result_list->quick_mode == 3 &&
page_size == roop_count &&
result_list->limit_num > roop_count &&
row
) {
The branch is not entered when we remove spider_quick_page_byte=0 from the SET statement, in which case the test case passes. The reason it is not entered in that case is because page_size != roop_count (== 0). The code path towards page_size having value 0 is rather convoluted and poorly documented.
The stack:
0 in Create_tmp_table::start of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:18953
1 in create_tmp_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:19794
2 in spider_mk_sys_tmp_table_for_result of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_sys_table.cc:3095
3 in spider_db_store_result of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_db_conn.cc:4004
4 in spider_bg_conn_action of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_conn.cc:2787
5 in asan_thread_start of ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
6 in start_thread of ./nptl/pthread_create.c:442
7 in clone of ../sysdeps/unix/sysv/linux/x86_64/clone.S:100
Yuchen Pei
added a comment - debug_assert_on_not_freed_memory is just a switch that allows auto assertion failure on nonzero status_var.local_memory_used .
safemalloc warnings look like it could be a hint:
Warning: 3624 bytes freed by T@4, allocated by T@9 at 0x5624a8732661, mysys/my_malloc.c:91, mysys/my_alloc.c:244, sql/sql_select.cc:18953, sql/sql_select.cc:19794, spider/spd_sys_table.cc:3095, spider/spd_db_conn.cc:4004, spider/spd_conn.cc:2787
which points to an if branch in spider_db_store_result() , called from a bg thread in spider_bg_conn_action() . The branch is entered
if (
result_list->quick_mode == 3 &&
page_size == roop_count &&
result_list->limit_num > roop_count &&
row
) {
The branch is not entered when we remove spider_quick_page_byte=0 from the SET statement, in which case the test case passes. The reason it is not entered in that case is because page_size != roop_count (== 0) . The code path towards page_size having value 0 is rather convoluted and poorly documented.
The stack:
0 in Create_tmp_table::start of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:18953
1 in create_tmp_table of /home/ycp/source/mariadb-server/10.5/src/sql/sql_select.cc:19794
2 in spider_mk_sys_tmp_table_for_result of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_sys_table.cc:3095
3 in spider_db_store_result of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_db_conn.cc:4004
4 in spider_bg_conn_action of /home/ycp/source/mariadb-server/10.5/src/storage/spider/spd_conn.cc:2787
5 in asan_thread_start of ../../../../src/libsanitizer/asan/asan_interceptors.cpp:234
6 in start_thread of ./nptl/pthread_create.c:442
7 in clone of ../sysdeps/unix/sysv/linux/x86_64/clone.S:100
Yuchen Pei
added a comment - - edited A simplified testcase to trigger the same assertion failure as in the description, tested at the current 10.5 1f306d395d00df158702d35b3338ccfe8663744e
--disable_query_log
--disable_result_log
--source ../../t/test_init.inc
--enable_result_log
--enable_query_log
evalp CREATE SERVER srv FOREIGN DATA WRAPPER mysql
OPTIONS (SOCKET "$MASTER_1_MYSOCK" , DATABASE 'test' , user 'root' );
CREATE TABLE t1 (c int );
CREATE TABLE t1_s (c int )
ENGINE=SPIDER COMMENT= 'wrapper "mariadb", srv "srv", table "t1"' ;
INSERT INTO t1 VALUES (42), (37);
set spider_same_server_link= 1;
set spider_quick_page_size= 1;
set spider_bgs_mode= 1;
SELECT * FROM t1_s;
drop table t1_s, t1;
drop server srv;
--disable_query_log
--disable_result_log
--source ../../t/test_deinit.inc
--enable_result_log
--enable_query_log
#14 0x000014dee20ac245 in ha_spider::rnd_next_internal (this=0x5250007cd948, buf=<optimized out>) at /test/11.8_dbg_san/storage/spider/ha_spider.cc:4394
#15 0x0000564b55876fe1 in handler::ha_rnd_next (this=0x5250007cd948, buf=<optimized out>) at /test/11.8_dbg_san/sql/handler.cc:3743
#16 0x0000564b54d9574f in collect_statistics_for_table (thd=<optimized out>, table=0x5190000c7b98) at /test/11.8_dbg_san/sql/sql_statistics.cc:2798
Please note that on 11.5+ we see a very different assert and stack, note the tmp table frames like free_tmp_table.
11.5.2 ea75a0b6009b0251e83193cd38c3974e36b65e06 (Debug)
mariadbd: /test/11.5_dbg/sql/mysqld.cc:3824: int temp_file_size_cb_func(tmp_file_tracking*, int): Assertion `thd->status_var.tmp_space_used >= track->previous_file_size' failed.
11.5.2 ea75a0b6009b0251e83193cd38c3974e36b65e06 (Debug)
Core was generated by `/test/MD130824-mariadb-11.5.2-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGABRT, Aborted.
Download failed: Invalid argument. Continuing without source file ./nptl/./nptl/pthread_kill.c.
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
warning: 44 ./nptl/pthread_kill.c: No such file or directory
[Current thread is 1 (LWP 158065)]
(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
#3 0x000014e69b84526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
#4 0x000014e69b8288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x000014e69b82881b in __assert_fail_base (fmt=0x14e69b9d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55df17168778 "thd->status_var.tmp_space_used >= track->previous_file_size", file=file@entry=0x55df1732a767 "/test/11.5_dbg/sql/mysqld.cc", line=line@entry=3824, function=function@entry=0x55df17168740 "int temp_file_size_cb_func(tmp_file_tracking*, int)") at ./assert/assert.c:94
#6 0x000014e69b83b507 in __assert_fail (assertion=0x55df17168778 "thd->status_var.tmp_space_used >= track->previous_file_size", file=0x55df1732a767 "/test/11.5_dbg/sql/mysqld.cc", line=3824, function=0x55df17168740 "int temp_file_size_cb_func(tmp_file_tracking*, int)") at ./assert/assert.c:103
#7 0x000055df162f0b05 in temp_file_size_cb_func (track=0x14e698747000, no_error=0) at /test/11.5_dbg/sql/mysqld.cc:3824
#8 0x000055df169639bd in _ma_update_tmp_file_size (track=<optimized out>, file_size=<optimized out>) at /test/11.5_dbg/storage/maria/ma_info.c:234
#9 0x000055df16970bc6 in ha_maria::drop_table (this=0x14e624029860, name=0x14e624018fa8 "/test/MD130824-mariadb-11.5.2-linux-x86_64-dbg/data/#sql-temptable-26593-8-0") at /test/11.5_dbg/storage/maria/ha_maria.cc:2939
#10 0x000055df164a0717 in free_tmp_table (thd=0x14e624000f98, entry=0x14e624018160) at /test/11.5_dbg/sql/sql_select.cc:22903
#11 0x000014e69811fbaf in spider_rm_sys_tmp_table_for_result (thd=<optimized out>, tmp_table=<optimized out>, tmp_tbl_prm=tmp_tbl_prm@entry=0x14e6240173f0)at /test/11.5_dbg/storage/spider/spd_sys_table.cc:3156
#12 0x000014e69812da01 in spider_db_free_one_result (result_list=result_list@entry=0x14e63c0e0250, result=0x14e6240173a8)at /test/11.5_dbg/storage/spider/spd_db_conn.cc:2824
#13 0x000014e6981322d2 in spider_db_seek_next (buf=0x14e63c0a43e0 "\377", spider=0x14e63c0dfc50, link_idx=0, table=0x14e63c0a3460)at /test/11.5_dbg/storage/spider/spd_db_conn.cc:4006
#14 0x000014e6981c4927 in spider_group_by_handler::next_row (this=0x14e63c37de70)at /test/11.5_dbg/storage/spider/spd_group_by_handler.cc:1369
#15 0x000055df164f949f in Pushdown_query::execute (this=0x14e63c01e930, join=join@entry=0x14e63c01c240)at /test/11.5_dbg/sql/group_by_handler.cc:64
#16 0x000055df164c735c in do_select (procedure=<optimized out>, join=0x14e63c01c240) at /test/11.5_dbg/sql/sql_select.cc:23058
#17 JOIN::exec_inner (this=this@entry=0x14e63c01c240)at /test/11.5_dbg/sql/sql_select.cc:5026
#18 0x000055df164c7d00 in JOIN::exec (this=this@entry=0x14e63c01c240)at /test/11.5_dbg/sql/sql_select.cc:4809
#19 0x000055df164c5ae7 in mysql_select (thd=thd@entry=0x14e63c000d58, tables=0x14e63c01b128, fields=@0x14e63c01ad00: {<base_list> = {<Sql_alloc> = {<No data fields>}, first = 0x14e63c01b0b8, last = 0x14e63c01b0b8, elements = 1}, <No data fields>}, conds=0x0, og_num=0, order=0x0, group=0x0, having=0x0, proc_param=0x0, select_options=2164525824, result=0x14e63c01c218, unit=0x14e63c005250, select_lex=0x14e63c01aa48) at /test/11.5_dbg/sql/sql_select.cc:5342
#20 0x000055df164c6310 in handle_select (thd=thd@entry=0x14e63c000d58, lex=lex@entry=0x14e63c005170, result=result@entry=0x14e63c01c218, setup_tables_done_option=setup_tables_done_option@entry=0)at /test/11.5_dbg/sql/sql_select.cc:628
#21 0x000055df16425efe in execute_sqlcom_select (thd=thd@entry=0x14e63c000d58, all_tables=0x14e63c01b128) at /test/11.5_dbg/sql/sql_parse.cc:6147
#22 0x000055df16431343 in mysql_execute_command (thd=thd@entry=0x14e63c000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.5_dbg/sql/sql_parse.cc:3953
#23 0x000055df16437841 in mysql_parse (thd=thd@entry=0x14e63c000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e698748290)at /test/11.5_dbg/sql/sql_parse.cc:7869
#24 0x000055df16439bc8 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e63c000d58, packet=packet@entry=0x14e63c00b329 "", packet_length=packet_length@entry=23, blocking=blocking@entry=true)at /test/11.5_dbg/sql/sql_class.h:256
#25 0x000055df1643bff0 in do_command (thd=0x14e63c000d58, blocking=blocking@entry=true) at /test/11.5_dbg/sql/sql_parse.cc:1405
#26 0x000055df165abb47 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55df1ad059a8, put_in_cache=put_in_cache@entry=true)at /test/11.5_dbg/sql/sql_connect.cc:1447
#27 0x000055df165abe3c in handle_one_connection (arg=arg@entry=0x55df1ad059a8)at /test/11.5_dbg/sql/sql_connect.cc:1349
#28 0x000055df16a0ea46 in pfs_spawn_thread (arg=0x55df1ac557a8)at /test/11.5_dbg/storage/perfschema/pfs.cc:2201
#29 0x000014e69b89ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#30 0x000014e69b929c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78