Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-37293

SIGSEGV in btr_block_get

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      Mysqld crash found on debug build

      Leads to :-

      CS 10.11.14 e79aa9ca382ce6d293edeab880212bf472c33f36 (Debug, Clang) Build 07/07/2025

      Core was generated by `/test/MD070725-mariadb-10.11.14-linux-x86_64-dbg/bin/mariadbd --no-defaults --m'.
      Program terminated with signal SIGSEGV, Segmentation fault.
      #0  0x00005ef5068b54ea in btr_block_get (index=..., page=3, latch_mode=RW_S_LATCH, merge=false, mtr=0x7838e3ffe3f8, err=0x7838e3ffdc44, first=0x0, page_get_mode=10)at /test/10.11_dbg/storage/innobase/btr/btr0btr.cc:233
      233	      buf_page_get_gen(page_id_t{index.table->space->id, page},
      [Current thread is 1 (LWP 1825711)]
      (gdb) bt
      #0  0x00005ef5068b54ea in btr_block_get (index=@0x78385004a520: {static MAX_N_FIELDS = 1023, id = 23, heap = 0x78385004a3b0, name = {m_name = 0x78385004a6b0 "GEN_CLUST_INDEX"}, table = 0x783850048040, page = 3, merge_threshold = 50, type = 1, trx_id_offset = 6, n_user_defined_cols = 0, n_uniq = 1, n_def = 4, n_fields = 4, n_nullable = 1, n_core_fields = 4, n_core_null_bytes = 1, static NO_CORE_NULL_BYTES = 255, static DICT_INDEXES_ID = 3, cached = 1, to_be_dropped = 0, online_status = 0, uncommitted = 0, is_dummy = false, in_instant_init = false, magic_n = 76789786, fields = 0x78385004a9c0, parser = 0x0, new_vcol_info = 0x0, change_col_info = 0x0, indexes = {prev = 0x0, next = 0x0}, search_info = 0x78385004aa40, online_log = 0x0, stat_n_diff_key_vals = 0x78385004aa28, stat_n_sample_sizes = 0x78385004aa30, stat_n_non_null_key_vals = 0x78385004aa38, stat_index_size = 1, stat_n_leaf_pages = 1, stat_defrag_modified_counter = 0, stat_defrag_n_pages_freed = 0, stat_defrag_n_page_split = 0, stat_defrag_data_size_sample = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}, stat_defrag_sample_next_slot = 0, rtr_ssn = {m = std::atomic<unsigned int> = { 0 }}, rtr_track = 0x0, trx_id = 15, zip_pad = {mutex = {<std::__mutex_base> = {_M_mutex = {__data = {__lock = 0, __count = 0, __owner = 0, __nusers = 0, __kind = 0, __spins = 0, __elision = 0, __list = {__prev = 0x0, __next = 0x0}}, __size = '\000' <repeats 39 times>, __align = 0}}, <No data fields>}, pad = {m = std::atomic<unsigned long> = { 0 }}, success = 0, failure = 0, n_rounds = 0}, lock = {lock = {writer = {lock = std::atomic<unsigned int> = { 3 }, static HOLDER = 1, static WAITER = 2}, readers = std::atomic<unsigned int> = { 0 }, static WRITER = 2147483648}, recursive = 65536, writer = std::atomic<unsigned long> = { 132185738704576 }, static FOR_IO = 18446744073709551615, readers_lock = {lock = std::atomic<unsigned int> = { 0 }, static HOLDER = 1, static WAITER = 2}, readers = std::atomic<std::unordered_multiset<unsigned long, std::hash<unsigned long>, std::equal_to<unsigned long>, std::allocator<unsigned long> > *> = { 0x7838500a4d00 }, static RECURSIVE_X = 1, static RECURSIVE_U = 65536, static RECURSIVE_MAX = 65535}}, page=3, latch_mode=RW_S_LATCH, merge=false, mtr=0x7838e3ffe3f8, err=0x7838e3ffdc44, first=0x0, page_get_mode=10)at /test/10.11_dbg/storage/innobase/btr/btr0btr.cc:233
      #1  0x00005ef5069b0ac5 in page_cur_open_level (page_cur=0x7838e3ffe048, level=0, mtr=0x7838e3ffe3f8)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:1302
      #2  0x00005ef5069b041e in btr_pcur_open_level (pcur=0x7838e3ffe048, level=0, mtr=0x7838e3ffe3f8, index=0x78385004a520)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:1364
      #3  0x00005ef5069af19d in dict_stats_analyze_index_level (index=0x78385004a520, level=0, n_diff=0x78385004aa28, total_recs=0x7838e3ffe3c8, total_pages=0x7838e3ffe3c0, n_diff_boundaries=0x0, mtr=0x7838e3ffe3f8)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:1458
      #4  0x00005ef5069a7fe9 in dict_stats_analyze_index (index=0x78385004a520)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:2395
      #5  0x00005ef5069a75b0 in dict_stats_update_persistent (table=0x783850048040)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:2655
      #6  0x00005ef5069a920b in dict_stats_update_persistent_try (table=0x783850048040)at /test/10.11_dbg/storage/innobase/dict/dict0stats.cc:2739
      #7  0x00005ef5069b71dc in dict_stats_process_entry_from_recalc_pool (thd=0x7838c40019b8)at /test/10.11_dbg/storage/innobase/dict/dict0stats_bg.cc:346
      #8  0x00005ef5069b6945 in dict_stats_func ()at /test/10.11_dbg/storage/innobase/dict/dict0stats_bg.cc:391
      #9  0x00005ef506a61ee4 in tpool::thread_pool_generic::timer_generic::run (this=0x5ef51b3c0f40) at /test/10.11_dbg/tpool/tpool_generic.cc:328
      #10 0x00005ef506a61d1d in tpool::thread_pool_generic::timer_generic::execute (arg=0x5ef51b3c0f40) at /test/10.11_dbg/tpool/tpool_generic.cc:348
      #11 0x00005ef506a65bdf in tpool::task::execute (this=0x5ef51b3c0f80)at /test/10.11_dbg/tpool/task.cc:37
      #12 0x00005ef506a5e803 in tpool::thread_pool_generic::worker_main (this=0x5ef51b303050, thread_var=0x5ef51b3034b0)at /test/10.11_dbg/tpool/tpool_generic.cc:566
      #13 0x00005ef506a63014 in std::__invoke_impl<void, void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*>(__f=@0x5ef51b3cf4b8: (void (tpool::thread_pool_generic::*)(tpool::thread_pool_generic * const, tpool::worker_data *)) 0x5ef506a5e6e0 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>, __t=@0x5ef51b3cf4b0: 0x5ef51b303050, __args=@0x5ef51b3cf4a8: 0x5ef51b3034b0)at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:74
      #14 0x00005ef506a62f35 in std::__invoke<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> (__fn=@0x5ef51b3cf4b8: (void (tpool::thread_pool_generic::*)(tpool::thread_pool_generic * const, tpool::worker_data *)) 0x5ef506a5e6e0 <tpool::thread_pool_generic::worker_main(tpool::worker_data*)>, __args=@0x5ef51b3cf4a8: 0x5ef51b3034b0, __args=@0x5ef51b3cf4a8: 0x5ef51b3034b0)at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/invoke.h:96
      #15 0x00005ef506a62f03 in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::_M_invoke<0ul, 1ul, 2ul> (this=0x5ef51b3cf4a8)at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:292
      #16 0x00005ef506a62eb5 in std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> >::operator() (this=0x5ef51b3cf4a8)at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:299
      #17 0x00005ef506a62d29 in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (tpool::thread_pool_generic::*)(tpool::worker_data*), tpool::thread_pool_generic*, tpool::worker_data*> > >::_M_run (this=0x5ef51b3cf4a0)at /usr/bin/../lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/std_thread.h:244
      #18 0x000078395aaecdb4 in std::execute_native_thread_routine (__p=0x5ef51b3cf4a0)at ../../../../../src/libstdc++-v3/src/c++11/thread.cc:104
      #19 0x000078395a69caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #20 0x000078395a729c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      Tried reproducing a test case but could not get a sql test case or RR trace hence sharing core dump with ldd files
      Core dump is present on SDP :
      /data/results/MDEV-37293/mysqld

      gdb -c core mariadbd

      Attachments

        Issue Links

          Activity

            People

              saahil Saahil Alam
              saahil Saahil Alam
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.