Daniel Black added a comment - 4 days ago page0cur.inl:272 rec = rec_convert_dtuple_to_rec((byte*) mem_heap_alloc(*heap, size), > C-style pointer casting index, tuple, n_ext); Discrepancy between mem_heap_alloc and use in rec_convert_dtuple_to_rec. 201 mach_write_to_2(rec - offs, 202 (mach_read_from_2(rec - offs) & ~mask) 203 | (val << shift)); 204 } 205 (rr) s 202 (mach_read_from_2(rec - offs) & ~mask) (rr) s mach_read_from_2 (b=0x71100001dbac "") at /source/storage/innobase/include/mach0data.inl:88 88 return(uint16_t(uint16_t(b[0]) << 8 | b[1])); (rr) s   Thread 1 hit Breakpoint 1, 0x00005592d746f6f4 in __msan_warning_with_origin_noreturn () A read of an undefined memory (mem_heap_alloc didn't init) and then or-ed to a value is undefined. diff --git a/storage/innobase/include/page0cur.inl b/storage/innobase/include/page0cur.inl index 828be6840d2..8375335cf51 100644 --- a/storage/innobase/include/page0cur.inl +++ b/storage/innobase/include/page0cur.inl @@ -269,7 +269,7 @@ page_cur_tuple_insert( * sizeof **offsets); } - rec = rec_convert_dtuple_to_rec((byte*) mem_heap_alloc(*heap, size), + rec = rec_convert_dtuple_to_rec((byte*) mem_heap_zalloc(*heap, size), index, tuple, n_ext); *offsets = rec_get_offsets(rec, index, *offsets, Resolve bootstrap and fails further on: mysqltest: Start processing test commands from './include/check-testcase.test' ... mysqltest: At line 91: query 'select count(*) from mysql.proc' failed: 2013: Lost connection to MySQL server during query     #1 0x000055d301a9563a in parse_sql (thd=0x72b00001c088, parser_state=0x7fe976519f00, creation_ctx=0x0, do_pfs_digest=false) at /source/sql/sql_parse.cc:10684 10684 MYSQLparse(thd)) != 0; (rr) list 10679 /* Parse the query. */ 10680 10681 bool mysql_parse_status= 10682 ((thd->variables.sql_mode & MODE_ORACLE) ? 10683 ORAparse(thd) : 10684 MYSQLparse(thd)) != 0; 10685 10686 if (mysql_parse_status) 10687 { 10688 /* (rr) p thd $1 = (THD *) 0x72b00001c088 (rr) p/x *(char*)0x22b00001c088 $2 = 0x0 (rr) p/x *(char*)0x22b00001c088@10 $3 = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}   #0 0x000055d302ff06b6 in MYSQLparse (thd=0x70e00002a268) at /build/sql/yy_mariadb.cc:28747 #1 0x000055d301a9563a in parse_sql (thd=0x72b00001c088, parser_state=0x7fe976519f00, creation_ctx=0x0, do_pfs_digest=false) at /source/sql/sql_parse.cc:10684 #2 0x000055d30248f8b2 in unpack_vcol_info_from_frm (thd=0x72b00001c088, table=0x719000030288, expr_str=0x7fe97651ba78, vcol_ptr=0x71200004d0e8, error_reported=0x7fe97651d73f) at /source/sql/table.cc:3812 #3 0x000055d30248d0f6 in parse_vcol_defs (thd=0x72b00001c088, mem_root=0x719000030588, table=0x719000030288, error_reported=0x7fe97651d73f, mode=VCOL_INIT_DEPENDENCY_FAILURE_IS_WARNING) at /source/sql/table.cc:1314 #4 0x000055d3024ba625 in open_table_from_share (thd=0x72b00001c088, share=0x71b00002f4a0, alias=0x71c0000100e8, db_stat=33, prgflag=8, ha_open_flags=16, outparam=0x719000030288, is_create_table=false, partitions_to_open=0x0) at /source/sql/table.cc:4216 #5 0x000055d3014b2eae in open_table (thd=0x72b00001c088, table_list=0x71c0000100a0, ot_ctx=0x7fe976520958) at /source/sql/sql_base.cc:2044 #6 0x000055d3014d4d88 in open_and_process_table (thd=0x72b00001c088, tables=0x71c0000100a0, counter=0x7fe976520c84, flags=0, prelocking_strategy=0x7fe976520d80, has_prelocking_list=false, ot_ctx=0x7fe976520958) at /source/sql/sql_base.cc:3839 #7 0x000055d3014cb32c in open_tables (thd=0x72b00001c088, options=..., start=0x7fe976520c98, counter=0x7fe976520c84, flags=0, prelocking_strategy=0x7fe976520d80) at /source/sql/sql_base.cc:4323 #8 0x000055d3014ea7a8 in open_and_lock_tables (thd=0x72b00001c088, options=..., tables=0x71c0000100a0, derived=true, flags=0, prelocking_strategy=0x7fe976520d80) at /source/sql/sql_base.cc:5270 #9 0x000055d301270644 in open_and_lock_tables (thd=0x72b00001c088, tables=0x71c0000100a0, derived=true, flags=0) at /source/sql/sql_base.h:509 #10 0x000055d301a6ceeb in execute_sqlcom_select (thd=0x72b00001c088, all_tables=0x71c0000100a0) at /source/sql/sql_parse.cc:6373 #11 0x000055d301a2a713 in mysql_execute_command (thd=0x72b00001c088) at /source/sql/sql_parse.cc:4043 #12 0x000055d3019f2027 in mysql_parse (thd=0x72b00001c088, rawbuf=0x711000014320 "select count(*) from mysql.proc", length=31, parser_state=0x7fe97652e868, is_com_multi=false, is_next_command=false) at /source/sql/sql_parse.cc:8252 #13 0x000055d3019ddbbc in dispatch_command (command=COM_QUERY, thd=0x72b00001c088, packet=0x729000069089 "select count(*) from mysql.proc", packet_length=31, is_com_multi=false, is_next_command=false) at /source/sql/sql_parse.cc:1891 #14 0x000055d3019f688c in do_command (thd=0x72b00001c088) at /source/sql/sql_parse.cc:1375 #15 0x000055d302785ac2 in do_handle_one_connection (connect=0x70e00001e708, put_in_cache=true) at /source/sql/sql_connect.cc:1386 #16 0x000055d3027843ce in handle_one_connection (arg=0x70e00001e708) at /source/sql/sql_connect.cc:1298 #17 0x000055d3051c6fc9 in pfs_spawn_thread (arg=0x715000005d08) at /source/storage/perfschema/pfs.cc:2201

Daniel Black added a comment - 4 days ago further on error is just overrunning the stack - the call function triggers the MSAN: (rr) disassemble Dump of assembler code for function _Z10MYSQLparseP3THD: 0x000055d302ff0680 <+0>: push %rbp 0x000055d302ff0681 <+1>: mov %rsp,%rbp 0x000055d302ff0684 <+4>: push %r15 0x000055d302ff0686 <+6>: push %r14 0x000055d302ff0688 <+8>: push %r13 0x000055d302ff068a <+10>: push %r12 0x000055d302ff068c <+12>: push %rbx 0x000055d302ff068d <+13>: sub $0x3cee8,%rsp 0x000055d302ff0694 <+20>: mov %rdi,-0x4380(%rbp) 0x000055d302ff069b <+27>: lea -0x2c(%rbp),%rdi 0x000055d302ff069f <+31>: movabs $0x500000000000,%rax 0x000055d302ff06a9 <+41>: xor %rax,%rdi 0x000055d302ff06ac <+44>: mov $0xff,%esi 0x000055d302ff06b1 <+49>: mov $0x4,%edx => 0x000055d302ff06b6 <+54>: call 0x55d300f11f99 <memset> Passes with more stack: $ MSAN_OPTIONS=abort_on_error=1:poison_in_dtor=1 mysql-test/mtr --mysqld=--thread-stack=$(( 1024 * 1024 )) main.select Logging: /source/mysql-test/mysql-test-run.pl --mysqld=--thread-stack=1048576 main.select VS config: vardir: /build/mysql-test/var Checking leftover processes... Removing old var directory... Creating var directory '/build/mysql-test/var'... Checking supported features... MariaDB Version 10.5.29-MariaDB-debug - SSL connections supported - binaries are debug compiled - binaries built with wsrep patch Collecting tests... Installing system database...   ==============================================================================   TEST RESULT TIME (ms) or COMMENT --------------------------------------------------------------------------   worker[01] Using MTR_BUILD_THREAD 300, with reserved ports 19000..19029 main.select [ pass ] 91927 -------------------------------------------------------------------------- diff --git a/storage/innobase/include/rem0rec.inl b/storage/innobase/include/rem0rec.inl index 30c72a7415a..e6d84aa2cd2 100644 --- a/storage/innobase/include/rem0rec.inl +++ b/storage/innobase/include/rem0rec.inl @@ -156,6 +156,9 @@ rec_set_bit_field_1( ut_ad(((mask >> shift) << shift) == mask); ut_ad(((val << shift) & mask) == (val << shift)); +#ifndef DBUG_OFF + MEM_MAKE_DEFINED(rec - offs, 1); +#endif mach_write_to_1(rec - offs, (mach_read_from_1(rec - offs) & ~mask) | (val << shift)); @@ -198,6 +201,9 @@ rec_set_bit_field_2( ut_ad(((mask >> shift) << shift) == mask); ut_ad(((val << shift) & mask) == (val << shift)); +#ifndef DBUG_OFF + MEM_MAKE_DEFINED(rec - offs, 2); +#endif mach_write_to_2(rec - offs, (mach_read_from_2(rec - offs) & ~mask) | (val << shift));