Details
-
Bug
-
Status: Open (View Workflow)
-
Major
-
Resolution: Unresolved
-
10.5, 10.6, 10.11, 11.4, 11.8, 12.0
-
None
Description
INSTALL SONAME 'ha_rocksdb'; |
SET sql_mode=''; |
CREATE TABLE t ENGINE=RocksDB AS SELECT NULL AS a FROM (SELECT 1) AS b UNION ALL SELECT NULL AS c FROM (SELECT 1) AS d; |
ALTER TABLE t ENGINE=RocksDB; |
Leads to:
|
CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025 |
mariadbd: /test/10.5_dbg_san/sql/sql_base.cc:830: int close_thread_tables(THD *): Assertion `check_field_pointers(table)' failed.
|
|
CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Debug, UBASAN, Clang) Build 15/02/2025 |
Core was generated by `/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-dbg/bin/mariadbd --no-defaul'.
|
Program terminated with signal SIGABRT, Aborted.
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
|
|
[Current thread is 1 (LWP 3311804)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=6)at ./nptl/pthread_kill.c:89
|
#3 0x0000621f78a1f7d5 in handle_fatal_signal (sig=<optimized out>)at /test/10.5_dbg_san/sql/signal_handler.cc:297
|
#4 <signal handler called>
|
#5 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
|
#6 __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#7 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
|
#8 0x000072784304526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
|
#9 0x00007278430288ff in __GI_abort () at ./stdlib/abort.c:79
|
#10 0x000072784302881b in __assert_fail_base (fmt=0x7278431d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x621f7acd76a0 <str> "check_field_pointers(table)", file=file@entry=0x621f7acd5920 "/test/10.5_dbg_san/sql/sql_base.cc", line=line@entry=830, function=function@entry=0x621f7acd7660 <__PRETTY_FUNCTION__._Z19close_thread_tablesP3THD> "int close_thread_tables(THD *)") at ./assert/assert.c:94
|
#11 0x000072784303b507 in __assert_fail (assertion=0x621f7acd76a0 <str> "check_field_pointers(table)", file=0x621f7acd5920 "/test/10.5_dbg_san/sql/sql_base.cc", line=830, function=0x621f7acd7660 <__PRETTY_FUNCTION__._Z19close_thread_tablesP3THD> "int close_thread_tables(THD *)") at ./assert/assert.c:103
|
#12 0x0000621f77acf95a in close_thread_tables (thd=thd@entry=0x52b00007e218)at /test/10.5_dbg_san/sql/sql_base.cc:830
|
#13 0x0000621f77d89281 in mysql_execute_command (thd=0x52b00007e218)at /test/10.5_dbg_san/sql/sql_parse.cc:6260
|
#14 0x0000621f77d58468 in mysql_parse (thd=thd@entry=0x52b00007e218, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x727721771710, is_com_multi=<optimized out>, is_next_command=<optimized out>)at /test/10.5_dbg_san/sql/sql_parse.cc:8252
|
#15 0x0000621f77d4c3ba in dispatch_command (command=<optimized out>, thd=0x52b00007e218, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>)at /test/10.5_dbg_san/sql/sql_parse.cc:1891
|
#16 0x0000621f77d5a5bf in do_command (thd=thd@entry=0x52b00007e218)at /test/10.5_dbg_san/sql/sql_parse.cc:1375
|
#17 0x0000621f78364258 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x508000002738, put_in_cache=true)at /test/10.5_dbg_san/sql/sql_connect.cc:1386
|
#18 0x0000621f78363b1c in handle_one_connection (arg=0x508000002738)at /test/10.5_dbg_san/sql/sql_connect.cc:1298
|
#19 0x0000621f7786d03d in asan_thread_start(void*) ()
|
#20 0x000072784309ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#21 0x0000727843129c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
|
CS 10.5.29 c43d0a015f974c5a0142e6779332089a7a979853 (Optimized, UBASAN, Clang) Build 15/02/2025 |
Core was generated by `/test/UBASAN_MD150225-mariadb-10.5.29-linux-x86_64-opt/bin/mariadbd --no-defaul'.
|
Program terminated with signal SIGSEGV, Segmentation fault.
|
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
|
|
|
[Current thread is 1 (LWP 3311801)]
|
(gdb) bt
|
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
|
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
|
#2 __GI___pthread_kill (threadid=<optimized out>, signo=11)at ./nptl/pthread_kill.c:89
|
#3 0x0000599e715370b0 in handle_fatal_signal (sig=<optimized out>)at /test/10.5_opt_san/sql/signal_handler.cc:297
|
#4 <signal handler called>
|
#5 0x0000726bcb510d0c in Field::set_null (this=this@entry=0x51900006af00, row_offset=row_offset@entry=0) at /test/10.5_opt_san/sql/./field.h:1408
|
#6 0x0000726bcb59752d in myrocks::Rdb_convert_to_record_value_decoder::decode(buf=<optimized out>, offset=offset@entry=0x726bcca711a8, table=0x51900006a998, field=0x51900006af00, field_dec=0x504000034868, reader=<optimized out>, decode=<optimized out>, is_null=<optimized out>)at /test/10.5_opt_san/storage/rocksdb/rdb_converter.cc:89
|
#7 0x0000726bcb5a06ad in myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next (this=this@entry=0x726bcca71160)at /test/10.5_opt_san/storage/rocksdb/rdb_converter.cc:272
|
#8 0x0000726bcb59c574 in myrocks::Rdb_converter::convert_record_from_storage_format (this=<optimized out>, pk_def=<optimized out>, key_slice=<optimized out>, value_slice=0x726bcca71080, dst=<optimized out>)at /test/10.5_opt_san/storage/rocksdb/rdb_converter.cc:614
|
#9 0x0000726bcb4345c6 in myrocks::ha_rocksdb::rnd_next_with_direction (this=0x51d0000816b8, buf=<optimized out>, move_forward=<optimized out>)at /test/10.5_opt_san/storage/rocksdb/ha_rocksdb.cc:10743
|
#10 0x0000726bcb447769 in myrocks::ha_rocksdb::rnd_next (this=0x51d0000816b8, buf=0x51900006aec8 "\377", '\276' <repeats 23 times>)at /test/10.5_opt_san/storage/rocksdb/ha_rocksdb.cc:10626
|
#11 0x0000599e715564dd in handler::ha_rnd_next (this=0x51d0000816b8, buf=0x51900006aec8 "\377", '\276' <repeats 23 times>)at /test/10.5_opt_san/sql/handler.cc:3188
|
#12 0x0000599e71ccf4cd in rr_sequential (info=info@entry=0x726bcce46020)at /test/10.5_opt_san/sql/records.cc:519
|
#13 0x0000599e70cb1edd in READ_RECORD::read_record (this=0x726bcce46020)at /test/10.5_opt_san/sql/records.h:80
|
#14 copy_data_between_tables (thd=<optimized out>, from=<optimized out>, to=<optimized out>, ignore=<optimized out>, order_num=<optimized out>, order=<optimized out>, copied=<optimized out>, deleted=<optimized out>, alter_info=<optimized out>, alter_ctx=<optimized out>)at /test/10.5_opt_san/sql/sql_table.cc:12045
|
#15 0x0000599e70c92aa3 in mysql_alter_table (thd=<optimized out>, new_db=<optimized out>, new_name=<optimized out>, create_info=0x726bcce35020, table_list=0x52b000085348, recreate_info=<optimized out>, alter_info=<optimized out>, order_num=<optimized out>, order=<optimized out>, ignore=<optimized out>, if_exists=<optimized out>) at /test/10.5_opt_san/sql/sql_table.cc:11457
|
#16 0x0000599e70edd603 in Sql_cmd_alter_table::execute (this=<optimized out>, thd=0x52b00007e218) at /test/10.5_opt_san/sql/sql_alter.cc:587
|
#17 0x0000599e7090a4f5 in mysql_execute_command (thd=0x52b00007e218)at /test/10.5_opt_san/sql/sql_parse.cc:6194
|
#18 0x0000599e708eb5a7 in mysql_parse (thd=0x52b00007e218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>)at /test/10.5_opt_san/sql/sql_parse.cc:8252
|
#19 0x0000599e708e01ff in dispatch_command (command=<optimized out>, thd=0x52b00007e218, packet=<optimized out>, packet_length=<optimized out>, is_com_multi=<optimized out>, is_next_command=<optimized out>)at /test/10.5_opt_san/sql/sql_parse.cc:1891
|
#20 0x0000599e708ed5a1 in do_command (thd=thd@entry=0x52b00007e218)at /test/10.5_opt_san/sql/sql_parse.cc:1375
|
#21 0x0000599e70ebc2f8 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x508000002738, put_in_cache=true)at /test/10.5_opt_san/sql/sql_connect.cc:1386
|
#22 0x0000599e70ebbb4b in handle_one_connection (arg=0x508000002738)at /test/10.5_opt_san/sql/sql_connect.cc:1298
|
#23 0x0000599e7044672d in asan_thread_start(void*) ()
|
#24 0x0000726d5369ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
|
#25 0x0000726d53729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
|
Depending on the build used, the crash happens on CREATE or on ALTER. When the CREATE succeeds, a SHOW CREATE TABLE shows the table as:
CREATE TABLE t (a null DEFAULT NULL) ENGINE=ROCKSDB DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci; |
Which is invalid. In that case the ALTER crashes the server.
|
Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.5 dbg 120425 e6ea5d568c0fb972a391a8c64716846ddb7c57ef check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 10.5 opt 120425 e6ea5d568c0fb972a391a8c64716846ddb7c57ef No bug found
|
CS 10.6 dbg 120425 690b2cf776faa2e1a6832077cec2246c86cd00bf check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 10.6 opt 120425 690b2cf776faa2e1a6832077cec2246c86cd00bf No bug found
|
CS 10.11 dbg 120425 acd071f599f416ddb4821dec485c4d912844213f check_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parse
|
CS 10.11 opt 120425 acd071f599f416ddb4821dec485c4d912844213f SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 11.4 dbg 120425 4a701e8ce4a178faf955641caf59fc13fcc718e9 check_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parse
|
CS 11.4 opt 120425 4a701e8ce4a178faf955641caf59fc13fcc718e9 No bug found
|
CS 11.8 dbg 120425 db5bb6f3339be5a49c0f397eb80a0f259f73f447 check_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parse
|
CS 11.8 opt 120425 db5bb6f3339be5a49c0f397eb80a0f259f73f447 SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 12.0 dbg 120425 22efc2c784e1b7199fb5804e6330168277ea7dce check_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parse
|
CS 12.0 opt 120425 22efc2c784e1b7199fb5804e6330168277ea7dce No bug found
|
ES 10.5 dbg 120425 0d368ec0042a81d9549fc939fb742f82350b20ab check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
ES 10.5 opt 120425 0d368ec0042a81d9549fc939fb742f82350b20ab SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
ES 10.6 dbg 120425 74602d1b054ba6c9ee20af79d6e7807440a7a98e check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
ES 10.6 opt 120425 74602d1b054ba6c9ee20af79d6e7807440a7a98e No bug found
|
ES 11.4 dbg 120425 9cd12544ebfd0d52d2158af66b5aced58121cf1f check_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parse
|
ES 11.4 opt 120425 9cd12544ebfd0d52d2158af66b5aced58121cf1f No bug found
|
MS 5.5 dbg 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
|
MS 5.5 opt 070123 bac287c315b1792e7ae33f91add6a60292f9bae8 No bug found
|
MS 5.6 dbg 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
|
MS 5.6 opt 070123 dab95781a1244104d6b87020ac2fc4d190ba2946 No bug found
|
MS 5.7 dbg 060224 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
|
MS 5.7 opt 060224 f7680e98b6bbe3500399fbad465d08a6b75d7a5c No bug found
|
MS 8.0 dbg 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
|
MS 8.0 opt 060224 49ef33f7edadef3ae04665e73d1babd40179a4f1 No bug found
|
MS 9.1 dbg 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
|
MS 9.1 opt 211024 61a3a1d8ef15512396b4c2af46e922a19bf2b174 No bug found
|
Optimized SAN builds react differently:
|
SAN Bug Detection Matrix |
Rel o/d Build Commit UniqueID observed
|
CS 10.5 dbg 150225 c43d0a015f974c5a0142e6779332089a7a979853 check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 10.5 opt 150225 c43d0a015f974c5a0142e6779332089a7a979853 SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 10.6 dbg 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 10.6 opt 150225 f1d7e0c17e33f77278e6226dd94aeb30fc856bf0 SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 10.11 dbg 150225 43c5d1303f5c7c726db276815c459436110f342f check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 10.11 opt 150225 43c5d1303f5c7c726db276815c459436110f342f SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 11.4 dbg 150225 ef966af801afc2a07222b5df65dddd52c77431dd check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 11.4 opt 150225 ef966af801afc2a07222b5df65dddd52c77431dd SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 11.8 dbg 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 11.8 opt 150225 33e0796e7a154e02a5e53c55cefc5d6feb4f5e6d SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
CS 12.0 dbg 150225 c92add291e636c797e6d6ddca605905541b2a441 check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
CS 12.0 opt 150225 c92add291e636c797e6d6ddca605905541b2a441 SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
ES 10.5 dbg 140325 6553c62369ab3606efc74295c902181f793fd6d1 check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
ES 10.5 opt 140325 6553c62369ab3606efc74295c902181f793fd6d1 SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
ES 10.6 dbg 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
ES 10.6 opt 140325 a99e9e4101f5d56a379577e6d81c829b7658df99 SIGSEGV|std::__shared_ptr<myrocks::Rdb_key_def,|std::shared_ptr<myrocks::Rdb_key_def>::operator=|myrocks::ha_rocksdb::create_table|myrocks::ha_rocksdb::create
|
ES 11.4 dbg 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba check_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command
|
ES 11.4 opt 140325 26e39c99feaa4e6f9d3e1b13fd4a7d101059b7ba SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_format
|
For the single ES 10.6 opt different stack alone, see MENT-2277. It is otherwise unrelated to this ticket.
Setup for SAN builds:
Compiled with a recent version of Clang (I used Clang 18.1.3) with LLVM 18. Ubuntu instructions:
|
# Note: It is strongly recommended to uninstall all old Clang & LLVM packages (ref dpkg --list | grep -iE 'clang|llvm' and use apt purge and dpkg --purge to remove the packages), before installing Clang/LLVM 18
|
sudo apt install clang llvm-18 llvm-18-linker-tools llvm-18-runtime llvm-18-tools llvm-18-dev libstdc++-14-dev llvm-dev
|
Compiled with: "-DCMAKE_C_COMPILER=/usr/bin/clang -DCMAKE_CXX_COMPILER=/usr/bin/clang++ -DCMAKE_C{,XX}_FLAGS='-march=native -mtune=native'" and:
|
-DWITH_ASAN=ON -DWITH_ASAN_SCOPE=ON -DWITH_UBSAN=ON -DWSREP_LIB_WITH_ASAN=ON
|
Set before execution:
|
export UBSAN_OPTIONS=print_stacktrace=1:report_error_type=1 # And you may also want to supress UBSAN startup issues using 'suppressions=UBSAN.filter' in UBSAN_OPTIONS. For an example of UBSAN.filter, which includes current startup issues see: https://github.com/mariadb-corporation/mariadb-qa/blob/master/UBSAN.filter
|
Testcase is CLI and MTR compatible.
Summary of 3 stacks relevant to this issue:
SIGSEGV|Field::set_null|myrocks::Rdb_convert_to_record_value_decoder::decode|myrocks::Rdb_value_field_iterator<myrocks::Rdb_convert_to_record_value_decoder>::next|myrocks::Rdb_converter::convert_record_from_storage_formatcheck_field_pointers(table)|SIGABRT|close_thread_tables|close_thread_tables_for_query|mysql_execute_command|mysql_parsecheck_field_pointers(table)|SIGABRT|close_thread_tables|mysql_execute_command|mysql_parse|dispatch_command