[MDEV-34782] SIGSEGV in handler::update_global_table_stats in close_thread_table() - Jira

Details

Type: Bug
Status: Closed (View Workflow)
Priority: Blocker
Resolution: Fixed
Affects Version/s: 11.6(EOL)
Fix Version/s: 11.6.2
Component/s: Data Definition - Create Table, Plugin - userstat
Labels:
- UBSAN
- regression-11.6

Description

SET sql_mode='';

CREATE TABLE t(c INT);

HANDLER t OPEN h;

INSERT INTO t VALUES();

SET GLOBAL userstat=1;

HANDLER h READ FIRST;

CREATE TABLE t(c INT);

Leads to:

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Optimized)
Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-opt/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000561ee6e5c3a2 in handler::update_global_table_stats (this=this@entry=0x1462e4022140) at /test/11.6_opt/sql/handler.cc:6109

warning: 6109 /test/11.6_opt/sql/handler.cc: No such file or directory
[Current thread is 1 (LWP 318661)]
(gdb) bt
#0 0x0000561ee6e5c3a2 in handler::update_global_table_stats (this=this@entry=0x1462e4022140) at /test/11.6_opt/sql/handler.cc:6109
#1 0x0000561ee6b3d632 in close_thread_table (thd=0x1462e4000c68, table_ptr=0x14633ff474e8) at /test/11.6_opt/sql/sql_base.cc:1016
#2 0x0000561ee6b75448 in mysql_ha_close_table (handler=0x1462e40236e0)at /test/11.6_opt/sql/sql_handler.cc:221
#3 0x0000561ee6b7729a in mysql_ha_rm_tables (thd=thd@entry=0x1462e4000c68, tables=<optimized out>) at /test/11.6_opt/sql/sql_handler.cc:1119
#4 0x0000561ee6bb9c8f in mysql_execute_command (thd=thd@entry=0x1462e4000c68, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_opt/sql/sql_parse.cc:3807
#5 0x0000561ee6bbec56 in mysql_parse (thd=0x1462e4000c68, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>) at /test/11.6_opt/sql/sql_parse.cc:7869
#6 0x0000561ee6bc0e75 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x1462e4000c68, packet=packet@entry=0x1462e4008869 "CREATE TABLE t(c INT)", packet_length=packet_length@entry=21, blocking=blocking@entry=true)at /test/11.6_opt/sql/sql_parse.cc:1991
#7 0x0000561ee6bc3443 in do_command (thd=0x1462e4000c68, blocking=blocking@entry=true) at /test/11.6_opt/sql/sql_parse.cc:1405
#8 0x0000561ee6cf446f in do_handle_one_connection (connect=<optimized out>, connect@entry=0x561ee9667618, put_in_cache=put_in_cache@entry=true)at /test/11.6_opt/sql/sql_connect.cc:1448
#9 0x0000561ee6cf47cd in handle_one_connection (arg=arg@entry=0x561ee9667618)at /test/11.6_opt/sql/sql_connect.cc:1350
#10 0x0000561ee70c1d2d in pfs_spawn_thread (arg=0x561ee968db98)at /test/11.6_opt/storage/perfschema/pfs.cc:2198
#11 0x000014634509ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#12 0x0000146345129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug)
Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd --defaults-group-su'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000563d5656b464 in handler::update_global_table_stats (this=this@entry=0x14e3b0205680) at /test/11.6_dbg/sql/handler.cc:6109

warning: 6109 /test/11.6_dbg/sql/handler.cc: No such file or directory
[Current thread is 1 (LWP 4061382)]
(gdb) bt
#0 0x0000563d5656b464 in handler::update_global_table_stats (this=this@entry=0x14e3b0205680) at /test/11.6_dbg/sql/handler.cc:6109
#1 0x0000563d561b2bb7 in close_thread_table (thd=thd@entry=0x14e3b0000d58, table_ptr=table_ptr@entry=0x14e3d013db50)at /test/11.6_dbg/sql/sql_base.cc:1016
#2 0x0000563d561f41f2 in mysql_ha_close_table (handler=handler@entry=0x14e3b003b0d0)at /test/11.6_dbg/sql/sql_handler.cc:221
#3 0x0000563d561f6e69 in mysql_ha_rm_tables (thd=thd@entry=0x14e3b0000d58, tables=<optimized out>) at /test/11.6_dbg/sql/sql_handler.cc:1119
#4 0x0000563d562407d7 in mysql_execute_command (thd=thd@entry=0x14e3b0000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_dbg/sql/sql_parse.cc:3807
#5 0x0000563d562470df in mysql_parse (thd=thd@entry=0x14e3b0000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14e3d013e250)at /test/11.6_dbg/sql/sql_parse.cc:7869
#6 0x0000563d56249466 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14e3b0000d58, packet=packet@entry=0x14e3b01004e9 "CREATE TABLE t(c INT)", packet_length=packet_length@entry=21, blocking=blocking@entry=true)at /test/11.6_dbg/sql/sql_class.h:256
#7 0x0000563d5624b88e in do_command (thd=0x14e3b0000d58, blocking=blocking@entry=true) at /test/11.6_dbg/sql/sql_parse.cc:1405
#8 0x0000563d563bcead in do_handle_one_connection (connect=<optimized out>, connect@entry=0x563d592d8508, put_in_cache=put_in_cache@entry=true)at /test/11.6_dbg/sql/sql_connect.cc:1448
#9 0x0000563d563bd1ae in handle_one_connection (arg=arg@entry=0x563d592d8508)at /test/11.6_dbg/sql/sql_connect.cc:1350
#10 0x0000563d56820039 in pfs_spawn_thread (arg=0x563d59257ff8)at /test/11.6_dbg/storage/perfschema/pfs.cc:2198
#11 0x000014e3d5e9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#12 0x000014e3d5f29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Git bisecting found this commit:

commit ecc7961140968b3a9d464b65786bb3a3ca92bb42

Author: Monty <monty@mariadb.org>

Date:   Thu Jul 11 14:52:23 2024 +0300

    MDEV-34571 Add page accessed and pages read from disk to table_stats

    Trivial batch, using the handler statistics already collected for

    the slow query log.

    The reason for the changes in test cases was mainly to change to use

    select TABLE_SCHEMA ... from information_schema.table_statistics instead

    of 'show table_statistics' to avoid future changes to test results

    if we add more columns to table_statistics.

Testcase is both CLI and MTR compatible.

Attachments

Issue Links

is caused by

MDEV-34571 Add page accessed and pages read from disk to table_stats

Closed

Activity

Ascending order - Click to sort in descending order

Roel Van de Paar added a comment - 2024-08-23 00:36

Additional testcase

CREATE TABLE t (a CHAR(1));

HANDLER t OPEN;

INSERT INTO t VALUES (1);

HANDLER t READ NEXT;

SET GLOBAL userstat=1;

HANDLER t close;

Leading to slightly different stack (frame #3 differs):

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug)
Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000055b006c90464 in handler::update_global_table_stats (this=this@entry=0x14b47402ab40) at /test/11.6_dbg/sql/handler.cc:6109

warning: 6109 /test/11.6_dbg/sql/handler.cc: No such file or directory
[Current thread is 1 (LWP 2355582)]
(gdb) bt
#0 0x000055b006c90464 in handler::update_global_table_stats (this=this@entry=0x14b47402ab40) at /test/11.6_dbg/sql/handler.cc:6109
#1 0x000055b0068d7bb7 in close_thread_table (thd=thd@entry=0x14b474000d58, table_ptr=table_ptr@entry=0x14b4d4b00b50)at /test/11.6_dbg/sql/sql_base.cc:1016
#2 0x000055b0069191f2 in mysql_ha_close_table (handler=handler@entry=0x14b47402d550)at /test/11.6_dbg/sql/sql_handler.cc:221
#3 0x000055b00691a054 in mysql_ha_close (thd=thd@entry=0x14b474000d58, tables=tables@entry=0x14b47401ac20)at /test/11.6_dbg/sql/sql_handler.cc:533
#4 0x000055b006969ce3 in mysql_execute_command (thd=thd@entry=0x14b474000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_dbg/sql/sql_parse.cc:5432
#5 0x000055b00696c0df in mysql_parse (thd=thd@entry=0x14b474000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b4d4b01250)at /test/11.6_dbg/sql/sql_parse.cc:7869
#6 0x000055b00696e466 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b474000d58, packet=packet@entry=0x14b47400b329 "HANDLER t close", packet_length=packet_length@entry=15, blocking=blocking@entry=true)at /test/11.6_dbg/sql/sql_class.h:256
#7 0x000055b00697088e in do_command (thd=0x14b474000d58, blocking=blocking@entry=true) at /test/11.6_dbg/sql/sql_parse.cc:1405
#8 0x000055b006ae1ead in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b00b41f208, put_in_cache=put_in_cache@entry=true)at /test/11.6_dbg/sql/sql_connect.cc:1448
#9 0x000055b006ae21ae in handle_one_connection (arg=arg@entry=0x55b00b41f208)at /test/11.6_dbg/sql/sql_connect.cc:1350
#10 0x000055b006f45039 in pfs_spawn_thread (arg=0x55b00b3f37a8)at /test/11.6_dbg/storage/perfschema/pfs.cc:2198
#11 0x000014b4d7a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#12 0x000014b4d7b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Testcase is both CLI and MTR compatible.

Roel Van de Paar added a comment - 2024-08-23 00:36 Additional testcase CREATE TABLE t (a CHAR (1)); HANDLER t OPEN ; INSERT INTO t VALUES (1); HANDLER t READ NEXT ; SET GLOBAL userstat=1; HANDLER t close ; Leading to slightly different stack (frame #3 differs): 11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug) Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x000055b006c90464 in handler::update_global_table_stats (this=this@entry=0x14b47402ab40) at /test/11.6_dbg/sql/handler.cc:6109 warning: 6109 /test/11.6_dbg/sql/handler.cc: No such file or directory [Current thread is 1 (LWP 2355582)] (gdb) bt #0 0x000055b006c90464 in handler::update_global_table_stats (this=this@entry=0x14b47402ab40) at /test/11.6_dbg/sql/handler.cc:6109 #1 0x000055b0068d7bb7 in close_thread_table (thd=thd@entry=0x14b474000d58, table_ptr=table_ptr@entry=0x14b4d4b00b50)at /test/11.6_dbg/sql/sql_base.cc:1016 #2 0x000055b0069191f2 in mysql_ha_close_table (handler=handler@entry=0x14b47402d550)at /test/11.6_dbg/sql/sql_handler.cc:221 #3 0x000055b00691a054 in mysql_ha_close (thd=thd@entry=0x14b474000d58, tables=tables@entry=0x14b47401ac20)at /test/11.6_dbg/sql/sql_handler.cc:533 #4 0x000055b006969ce3 in mysql_execute_command (thd=thd@entry=0x14b474000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_dbg/sql/sql_parse.cc:5432 #5 0x000055b00696c0df in mysql_parse (thd=thd@entry=0x14b474000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b4d4b01250)at /test/11.6_dbg/sql/sql_parse.cc:7869 #6 0x000055b00696e466 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b474000d58, packet=packet@entry=0x14b47400b329 "HANDLER t close", packet_length=packet_length@entry=15, blocking=blocking@entry=true)at /test/11.6_dbg/sql/sql_class.h:256 #7 0x000055b00697088e in do_command (thd=0x14b474000d58, blocking=blocking@entry=true) at /test/11.6_dbg/sql/sql_parse.cc:1405 #8 0x000055b006ae1ead in do_handle_one_connection (connect=<optimized out>, connect@entry=0x55b00b41f208, put_in_cache=put_in_cache@entry=true)at /test/11.6_dbg/sql/sql_connect.cc:1448 #9 0x000055b006ae21ae in handle_one_connection (arg=arg@entry=0x55b00b41f208)at /test/11.6_dbg/sql/sql_connect.cc:1350 #10 0x000055b006f45039 in pfs_spawn_thread (arg=0x55b00b3f37a8)at /test/11.6_dbg/storage/perfschema/pfs.cc:2198 #11 0x000014b4d7a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #12 0x000014b4d7b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Testcase is both CLI and MTR compatible.

Roel Van de Paar added a comment - 2024-08-23 00:42 - edited

UBSAN also sees a member access within null pointer.

Stack for the first testcase:

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug, UBASAN)
2024-08-23 10:38:17 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections.
Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 10022 MariaDB Server
/test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats'
#0 0x55deda3a8954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109
#1 0x55ded85eb95a in close_thread_table(THD, TABLE*) /test/11.6_dbg_san/sql/sql_base.cc:1016
#2 0x55ded87dcb18 in mysql_ha_close_table /test/11.6_dbg_san/sql/sql_handler.cc:221
#3 0x55ded87ed69a in mysql_ha_rm_tables(THD, TABLE_LIST) /test/11.6_dbg_san/sql/sql_handler.cc:1119
#4 0x55ded8a73d39 in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:3807
#5 0x55ded8a9db3b in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869
#6 0x55ded8aad9a9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892
#7 0x55ded8abc51a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405
#8 0x55ded9507d65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448
#9 0x55ded950928c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350
#10 0x151d9c49ca93 in start_thread nptl/pthread_create.c:447
#11 0x151d9c529c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Stack for the second testcase:

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug, UBASAN)
2024-08-23 10:41:21 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections.
Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 10377 MariaDB Server
/test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats'
#0 0x5626ffb19954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109
#1 0x5626fdd5c95a in close_thread_table(THD, TABLE*) /test/11.6_dbg_san/sql/sql_base.cc:1016
#2 0x5626fdf4db18 in mysql_ha_close_table /test/11.6_dbg_san/sql/sql_handler.cc:221
#3 0x5626fdf530d5 in mysql_ha_close(THD, TABLE_LIST) /test/11.6_dbg_san/sql/sql_handler.cc:533
#4 0x5626fe2019e0 in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:5432
#5 0x5626fe20eb3b in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869
#6 0x5626fe21e9a9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892
#7 0x5626fe22d51a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405
#8 0x5626fec78d65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448
#9 0x5626fec7a28c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350
#10 0x148fa609ca93 in start_thread nptl/pthread_create.c:447
#11 0x148fa6129c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-08-23 00:42 - edited UBSAN also sees a member access within null pointer. Stack for the first testcase: 11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug, UBASAN) 2024-08-23 10:38:17 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections. Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 10022 MariaDB Server /test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats' #0 0x55deda3a8954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109 #1 0x55ded85eb95a in close_thread_table(THD*, TABLE**) /test/11.6_dbg_san/sql/sql_base.cc:1016 #2 0x55ded87dcb18 in mysql_ha_close_table /test/11.6_dbg_san/sql/sql_handler.cc:221 #3 0x55ded87ed69a in mysql_ha_rm_tables(THD*, TABLE_LIST*) /test/11.6_dbg_san/sql/sql_handler.cc:1119 #4 0x55ded8a73d39 in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:3807 #5 0x55ded8a9db3b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869 #6 0x55ded8aad9a9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892 #7 0x55ded8abc51a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405 #8 0x55ded9507d65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448 #9 0x55ded950928c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350 #10 0x151d9c49ca93 in start_thread nptl/pthread_create.c:447 #11 0x151d9c529c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Stack for the second testcase: 11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug, UBASAN) 2024-08-23 10:41:21 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections. Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 10377 MariaDB Server /test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats' #0 0x5626ffb19954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109 #1 0x5626fdd5c95a in close_thread_table(THD*, TABLE**) /test/11.6_dbg_san/sql/sql_base.cc:1016 #2 0x5626fdf4db18 in mysql_ha_close_table /test/11.6_dbg_san/sql/sql_handler.cc:221 #3 0x5626fdf530d5 in mysql_ha_close(THD*, TABLE_LIST*) /test/11.6_dbg_san/sql/sql_handler.cc:533 #4 0x5626fe2019e0 in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:5432 #5 0x5626fe20eb3b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869 #6 0x5626fe21e9a9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892 #7 0x5626fe22d51a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405 #8 0x5626fec78d65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448 #9 0x5626fec7a28c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350 #10 0x148fa609ca93 in start_thread nptl/pthread_create.c:447 #11 0x148fa6129c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Roel Van de Paar added a comment - 2024-08-23 05:23 - edited

Additional stack with:

CREATE TABLE t (c INT);

INSERT INTO t (c) VALUES (1);

LOCK TABLE t READ;

SELECT * FROM t;

SET GLOBAL userstat=ON;

LOCK TABLES t AS a2 READ;

Leads to:

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug)
Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000564bafbfb464 in handler::update_global_table_stats (this=this@entry=0x14b5c002a6e0) at /test/11.6_dbg/sql/handler.cc:6109

warning: 6109 /test/11.6_dbg/sql/handler.cc: No such file or directory
[Current thread is 1 (LWP 2153930)]
(gdb) bt
#0 0x0000564bafbfb464 in handler::update_global_table_stats (this=this@entry=0x14b5c002a6e0) at /test/11.6_dbg/sql/handler.cc:6109
#1 0x0000564baf842bb7 in close_thread_table (thd=thd@entry=0x14b5c0000d58, table_ptr=table_ptr@entry=0x14b5c0000e50)at /test/11.6_dbg/sql/sql_base.cc:1016
#2 0x0000564baf84315b in close_thread_tables (thd=thd@entry=0x14b5c0000d58)at /test/11.6_dbg/sql/sql_base.cc:981
#3 0x0000564baf843d82 in Locked_tables_list::unlock_locked_tables (this=this@entry=0x14b5c0005060, thd=thd@entry=0x14b5c0000d58)at /test/11.6_dbg/sql/sql_base.cc:2633
#4 0x0000564baf8d3239 in mysql_execute_command (thd=thd@entry=0x14b5c0000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_dbg/sql/sql_parse.cc:4888
#5 0x0000564baf8d70df in mysql_parse (thd=thd@entry=0x14b5c0000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b6155fe250)at /test/11.6_dbg/sql/sql_parse.cc:7869
#6 0x0000564baf8d9466 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b5c0000d58, packet=packet@entry=0x14b5c000b329 "LOCK TABLES t AS a2 READ", packet_length=packet_length@entry=24, blocking=blocking@entry=true)at /test/11.6_dbg/sql/sql_class.h:256
#7 0x0000564baf8db88e in do_command (thd=0x14b5c0000d58, blocking=blocking@entry=true) at /test/11.6_dbg/sql/sql_parse.cc:1405
#8 0x0000564bafa4cead in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564bb24a2f38, put_in_cache=put_in_cache@entry=true)at /test/11.6_dbg/sql/sql_connect.cc:1448
#9 0x0000564bafa4d1ae in handle_one_connection (arg=arg@entry=0x564bb24a2f38)at /test/11.6_dbg/sql/sql_connect.cc:1350
#10 0x0000564bafeb0039 in pfs_spawn_thread (arg=0x564bb246d5f8)at /test/11.6_dbg/storage/perfschema/pfs.cc:2198
#11 0x000014b62169ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#12 0x000014b621729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

And additional UBSAN stack:

11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug)
2024-08-23 15:21:14 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections.
Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 11643 MariaDB Server
/test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats'
#0 0x5649af14f954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109
#1 0x5649ad39295a in close_thread_table(THD, TABLE*) /test/11.6_dbg_san/sql/sql_base.cc:1016
#2 0x5649ad395aa6 in close_thread_tables(THD*) /test/11.6_dbg_san/sql/sql_base.cc:981
#3 0x5649ad399b42 in Locked_tables_list::unlock_locked_tables(THD*) /test/11.6_dbg_san/sql/sql_base.cc:2633
#4 0x5649ad82f0cc in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:4888
#5 0x5649ad844b3b in mysql_parse(THD, char, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869
#6 0x5649ad8549a9 in dispatch_command(enum_server_command, THD, char, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892
#7 0x5649ad86351a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405
#8 0x5649ae2aed65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448
#9 0x5649ae2b028c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350
#10 0x1483bf09ca93 in start_thread nptl/pthread_create.c:447
#11 0x1483bf129c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Testcase is again both CLI and MTR compatible.

Roel Van de Paar added a comment - 2024-08-23 05:23 - edited Additional stack with: CREATE TABLE t (c INT ); INSERT INTO t (c) VALUES (1); LOCK TABLE t READ ; SELECT * FROM t; SET GLOBAL userstat= ON ; LOCK TABLES t AS a2 READ ; Leads to: 11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug) Core was generated by `/test/MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000564bafbfb464 in handler::update_global_table_stats (this=this@entry=0x14b5c002a6e0) at /test/11.6_dbg/sql/handler.cc:6109 warning: 6109 /test/11.6_dbg/sql/handler.cc: No such file or directory [Current thread is 1 (LWP 2153930)] (gdb) bt #0 0x0000564bafbfb464 in handler::update_global_table_stats (this=this@entry=0x14b5c002a6e0) at /test/11.6_dbg/sql/handler.cc:6109 #1 0x0000564baf842bb7 in close_thread_table (thd=thd@entry=0x14b5c0000d58, table_ptr=table_ptr@entry=0x14b5c0000e50)at /test/11.6_dbg/sql/sql_base.cc:1016 #2 0x0000564baf84315b in close_thread_tables (thd=thd@entry=0x14b5c0000d58)at /test/11.6_dbg/sql/sql_base.cc:981 #3 0x0000564baf843d82 in Locked_tables_list::unlock_locked_tables (this=this@entry=0x14b5c0005060, thd=thd@entry=0x14b5c0000d58)at /test/11.6_dbg/sql/sql_base.cc:2633 #4 0x0000564baf8d3239 in mysql_execute_command (thd=thd@entry=0x14b5c0000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/11.6_dbg/sql/sql_parse.cc:4888 #5 0x0000564baf8d70df in mysql_parse (thd=thd@entry=0x14b5c0000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14b6155fe250)at /test/11.6_dbg/sql/sql_parse.cc:7869 #6 0x0000564baf8d9466 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14b5c0000d58, packet=packet@entry=0x14b5c000b329 "LOCK TABLES t AS a2 READ", packet_length=packet_length@entry=24, blocking=blocking@entry=true)at /test/11.6_dbg/sql/sql_class.h:256 #7 0x0000564baf8db88e in do_command (thd=0x14b5c0000d58, blocking=blocking@entry=true) at /test/11.6_dbg/sql/sql_parse.cc:1405 #8 0x0000564bafa4cead in do_handle_one_connection (connect=<optimized out>, connect@entry=0x564bb24a2f38, put_in_cache=put_in_cache@entry=true)at /test/11.6_dbg/sql/sql_connect.cc:1448 #9 0x0000564bafa4d1ae in handle_one_connection (arg=arg@entry=0x564bb24a2f38)at /test/11.6_dbg/sql/sql_connect.cc:1350 #10 0x0000564bafeb0039 in pfs_spawn_thread (arg=0x564bb246d5f8)at /test/11.6_dbg/storage/perfschema/pfs.cc:2198 #11 0x000014b62169ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #12 0x000014b621729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 And additional UBSAN stack: 11.6.1 05fe3f1c186a221c4455b4d83a9d59f09f2dfadb (Debug) 2024-08-23 15:21:14 0 [Note] /test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/bin/mariadbd: ready for connections. Version: '11.6.1-MariaDB-debug' socket: '/test/UBASAN_MD130824-mariadb-11.6.1-linux-x86_64-dbg/socket.sock' port: 11643 MariaDB Server /test/11.6_dbg_san/sql/handler.cc:6109:59: runtime error: member access within null pointer of type 'struct ha_handler_stats' #0 0x5649af14f954 in handler::update_global_table_stats() /test/11.6_dbg_san/sql/handler.cc:6109 #1 0x5649ad39295a in close_thread_table(THD*, TABLE**) /test/11.6_dbg_san/sql/sql_base.cc:1016 #2 0x5649ad395aa6 in close_thread_tables(THD*) /test/11.6_dbg_san/sql/sql_base.cc:981 #3 0x5649ad399b42 in Locked_tables_list::unlock_locked_tables(THD*) /test/11.6_dbg_san/sql/sql_base.cc:2633 #4 0x5649ad82f0cc in mysql_execute_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:4888 #5 0x5649ad844b3b in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/11.6_dbg_san/sql/sql_parse.cc:7869 #6 0x5649ad8549a9 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1892 #7 0x5649ad86351a in do_command(THD*, bool) /test/11.6_dbg_san/sql/sql_parse.cc:1405 #8 0x5649ae2aed65 in do_handle_one_connection(CONNECT*, bool) /test/11.6_dbg_san/sql/sql_connect.cc:1448 #9 0x5649ae2b028c in handle_one_connection /test/11.6_dbg_san/sql/sql_connect.cc:1350 #10 0x1483bf09ca93 in start_thread nptl/pthread_create.c:447 #11 0x1483bf129c3b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Testcase is again both CLI and MTR compatible.

Roel Van de Paar added a comment - 2024-09-14 05:00

Additional stack with

CREATE TABLE t (id INT);

LOCK TABLE t WRITE;

INSERT INTO t VALUES (1);

SET GLOBAL userstat=1;

FLUSH TABLES;

Leads to:

CS 11.7.0 5bbda9711131845ae6b4315a268b4d1710943a85 (Debug)
Core was generated by `/test/MD090924-mariadb-11.7.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x0000565001782bdc in handler::update_global_table_stats (this=this@entry=0x14dd5002a720) at /test/server_dbg/sql/handler.cc:6128

[Current thread is 1 (LWP 2239897)]
(gdb) bt
#0 0x0000565001782bdc in handler::update_global_table_stats (this=this@entry=0x14dd5002a720) at /test/server_dbg/sql/handler.cc:6128
#1 0x00005650013c75f7 in close_thread_table (thd=thd@entry=0x14dd50000d58, table_ptr=table_ptr@entry=0x14dd50000e50)at /test/server_dbg/sql/sql_base.cc:1016
#2 0x00005650013c8b83 in close_all_tables_for_name (thd=thd@entry=0x14dd50000d58, share=<optimized out>, extra=extra@entry=HA_EXTRA_NOT_USED, skip_table=skip_table@entry=0x0)at /test/server_dbg/sql/sql_base.cc:776
#3 0x00005650013d2c7a in close_cached_tables (thd=thd@entry=0x14dd50000d58, tables=tables@entry=0x0, wait_for_refresh=wait_for_refresh@entry=true, timeout=86400) at /test/server_dbg/sql/sql_base.cc:403
#4 0x000056500160e5f3 in reload_acl_and_cache (thd=thd@entry=0x14dd50000d58, options=4, tables=tables@entry=0x0, write_to_binlog=write_to_binlog@entry=0x14ddad967de0)at /test/server_dbg/sql/sql_reload.cc:360
#5 0x0000565001458df5 in mysql_execute_command (thd=thd@entry=0x14dd50000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/server_dbg/sql/sql_parse.cc:5317
#6 0x000056500145b78c in mysql_parse (thd=thd@entry=0x14dd50000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14ddad968260)at /test/server_dbg/sql/sql_parse.cc:7876
#7 0x000056500145dc23 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14dd50000d58, packet=packet@entry=0x14dd5000b329 "FLUSH TABLES", packet_length=packet_length@entry=12, blocking=blocking@entry=true)at /test/server_dbg/sql/sql_class.h:256
#8 0x000056500145ff71 in do_command (thd=0x14dd50000d58, blocking=blocking@entry=true) at /test/server_dbg/sql/sql_parse.cc:1405
#9 0x00005650015d8218 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56500456d8a8, put_in_cache=put_in_cache@entry=true)at /test/server_dbg/sql/sql_connect.cc:1448
#10 0x00005650015d8524 in handle_one_connection (arg=arg@entry=0x56500456d8a8)at /test/server_dbg/sql/sql_connect.cc:1350
#11 0x0000565001a2cf79 in pfs_spawn_thread (arg=0x5650044d7838)at /test/server_dbg/storage/perfschema/pfs.cc:2198
#12 0x000014ddb0a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#13 0x000014ddb0b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Testcase is both CLI and MTR compatible.

Roel Van de Paar added a comment - 2024-09-14 05:00 Additional stack with CREATE TABLE t (id INT ); LOCK TABLE t WRITE; INSERT INTO t VALUES (1); SET GLOBAL userstat=1; FLUSH TABLES; Leads to: CS 11.7.0 5bbda9711131845ae6b4315a268b4d1710943a85 (Debug) Core was generated by `/test/MD090924-mariadb-11.7.0-linux-x86_64-dbg/bin/mariadbd --no-defaults --max'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x0000565001782bdc in handler::update_global_table_stats (this=this@entry=0x14dd5002a720) at /test/server_dbg/sql/handler.cc:6128 [Current thread is 1 (LWP 2239897)] (gdb) bt #0 0x0000565001782bdc in handler::update_global_table_stats (this=this@entry=0x14dd5002a720) at /test/server_dbg/sql/handler.cc:6128 #1 0x00005650013c75f7 in close_thread_table (thd=thd@entry=0x14dd50000d58, table_ptr=table_ptr@entry=0x14dd50000e50)at /test/server_dbg/sql/sql_base.cc:1016 #2 0x00005650013c8b83 in close_all_tables_for_name (thd=thd@entry=0x14dd50000d58, share=<optimized out>, extra=extra@entry=HA_EXTRA_NOT_USED, skip_table=skip_table@entry=0x0)at /test/server_dbg/sql/sql_base.cc:776 #3 0x00005650013d2c7a in close_cached_tables (thd=thd@entry=0x14dd50000d58, tables=tables@entry=0x0, wait_for_refresh=wait_for_refresh@entry=true, timeout=86400) at /test/server_dbg/sql/sql_base.cc:403 #4 0x000056500160e5f3 in reload_acl_and_cache (thd=thd@entry=0x14dd50000d58, options=4, tables=tables@entry=0x0, write_to_binlog=write_to_binlog@entry=0x14ddad967de0)at /test/server_dbg/sql/sql_reload.cc:360 #5 0x0000565001458df5 in mysql_execute_command (thd=thd@entry=0x14dd50000d58, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false)at /test/server_dbg/sql/sql_parse.cc:5317 #6 0x000056500145b78c in mysql_parse (thd=thd@entry=0x14dd50000d58, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x14ddad968260)at /test/server_dbg/sql/sql_parse.cc:7876 #7 0x000056500145dc23 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x14dd50000d58, packet=packet@entry=0x14dd5000b329 "FLUSH TABLES", packet_length=packet_length@entry=12, blocking=blocking@entry=true)at /test/server_dbg/sql/sql_class.h:256 #8 0x000056500145ff71 in do_command (thd=0x14dd50000d58, blocking=blocking@entry=true) at /test/server_dbg/sql/sql_parse.cc:1405 #9 0x00005650015d8218 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x56500456d8a8, put_in_cache=put_in_cache@entry=true)at /test/server_dbg/sql/sql_connect.cc:1448 #10 0x00005650015d8524 in handle_one_connection (arg=arg@entry=0x56500456d8a8)at /test/server_dbg/sql/sql_connect.cc:1350 #11 0x0000565001a2cf79 in pfs_spawn_thread (arg=0x5650044d7838)at /test/server_dbg/storage/perfschema/pfs.cc:2198 #12 0x000014ddb0a9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447 #13 0x000014ddb0b29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 Testcase is both CLI and MTR compatible.

Michael Widenius added a comment - 2024-10-09 13:45

Handler statistics did not take into account that it could not be fully initialized in the table.

Michael Widenius added a comment - 2024-10-09 13:45 Handler statistics did not take into account that it could not be fully initialized in the table.

Michael Widenius added a comment - 2024-10-09 14:23

Pushed to bb-11.6-monty for testing

Michael Widenius added a comment - 2024-10-09 14:23 Pushed to bb-11.6-monty for testing

Michael Widenius added a comment - 2024-10-09 15:09

Fix pushed to 11.6 tree

Michael Widenius added a comment - 2024-10-09 15:09 Fix pushed to 11.6 tree

People

Assignee:: Michael Widenius

Reporter:: Roel Van de Paar

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2024-08-20 03:42

Updated:: 2024-10-22 12:10

Resolved:: 2024-10-09 15:09

Git Integration

Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.