Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-38442

Assertion `share->tdc->ref_count' failed in tdc_release_share on BEGIN

    XMLWordPrintable

Details

    • Can result in hang or crash

    Description

      SET pseudo_slave_mode=1;
      CREATE GLOBAL TEMPORARY TABLE t (c INT);
      LOCK TABLES t READ;
      CREATE TEMPORARY TABLE t1 LIKE t;
      BEGIN;
      

      Leads to:

      MDEV-35915 CS 12.2.0 228260ead7d9343e81a6d73bc0eb7ec96718d917 (Debug, Clang 21.1.3-20250923) Build 27/12/2025

      mariadbd: /test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc:986: void tdc_release_share(TABLE_SHARE *): Assertion `share->tdc->ref_count' failed.
      

      MDEV-35915 CS 12.2.0 228260ead7d9343e81a6d73bc0eb7ec96718d917 (Debug, Clang 21.1.3-20250923) Build 27/12/2025

      Core was generated by `/test/MDEV-35915_v9_MD271225-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadbd --no-'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 2856192)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #3  0x00007b1cfc44526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #4  0x00007b1cfc4288ff in __GI_abort () at ./stdlib/abort.c:79
      #5  0x00007b1cfc42881b in __assert_fail_base (fmt=0x7b1cfc5d01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5ef9510e945b "share->tdc->ref_count", file=file@entry=0x5ef95104d480 "/test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc", line=line@entry=986, function=function@entry=0x5ef951014d22 "void tdc_release_share(TABLE_SHARE *)") at ./assert/assert.c:94
      #6  0x00007b1cfc43b507 in __assert_fail (assertion=0x5ef9510e945b "share->tdc->ref_count", file=0x5ef95104d480 "/test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc", line=986, function=0x5ef951014d22 "void tdc_release_share(TABLE_SHARE *)")at ./assert/assert.c:103
      #7  0x00005ef952008aa5 in tdc_release_share (share=0x7b1bcc030db0)at /test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc:986
      #8  0x00005ef952006b23 in intern_close_table (table=0x7b1bcc028268)at /test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc:231
      #9  0x00005ef952006f49 in tc_remove_table (table=0x7b1bcc028268)at /test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc:268
      #10 0x00005ef95200742f in tc_release_table (table=0x7b1bcc028268)at /test/bb-12.2-nikita-global-tmp_dbg/sql/table_cache.cc:461
      #11 0x00005ef951b696af in close_thread_table (thd=0x7b1bcc000d58, table_ptr=0x7b1bcc000ed0)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_base.cc:1088
      #12 0x00005ef951b69cf8 in close_thread_tables (thd=0x7b1bcc000d58)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_base.cc:1019
      #13 0x00005ef951b6ddc1 in Locked_tables_list::unlock_locked_tables (this=0x7b1bcc004f68, thd=0x7b1bcc000d58)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_base.cc:2752
      #14 0x00005ef951ed6722 in trans_begin (thd=0x7b1bcc000d58, flags=0)at /test/bb-12.2-nikita-global-tmp_dbg/sql/transaction.cc:110
      #15 0x00005ef951cd31d1 in mysql_execute_command (thd=0x7b1bcc000d58, is_called_from_prepared_stmt=false)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_parse.cc:5487
      #16 0x00005ef951cc5c18 in mysql_parse (thd=0x7b1bcc000d58, rawbuf=0x7b1bcc019e80 "BEGIN", length=5, parser_state=0x7b1cf82e6a10)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_parse.cc:7911
      #17 0x00005ef951cc33f9 in dispatch_command (command=COM_QUERY, thd=0x7b1bcc000d58, packet=0x7b1bcc00b1f9 "BEGIN", packet_length=5, blocking=true) at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_parse.cc:1898
      #18 0x00005ef951cc669a in do_command (thd=0x7b1bcc000d58, blocking=true)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_parse.cc:1437
      #19 0x00005ef951eb904e in do_handle_one_connection (connect=0x5ef9548bd118, put_in_cache=true)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_connect.cc:1414
      #20 0x00005ef951eb8e31 in handle_one_connection (arg=0x5ef9549454c8)at /test/bb-12.2-nikita-global-tmp_dbg/sql/sql_connect.cc:1326
      #21 0x00007b1cfc49ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #22 0x00007b1cfc529c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      And somewhat surprisingly, on UBASAN builds this leads to a slightly different stack (note close_thread_tables appearing earlier in the stack):

      MDEV-35915 CS 12.2.0 228260ead7d9343e81a6d73bc0eb7ec96718d917 (Debug, UBASAN, Clang 21.1.3-20250923) Build 27/12/2025

      mariadbd: /test/bb-12.2-nikita-global-tmp_dbg_san/sql/table_cache.cc:986: void tdc_release_share(TABLE_SHARE *): Assertion `share->tdc->ref_count' failed.
      

      MDEV-35915 CS 12.2.0 228260ead7d9343e81a6d73bc0eb7ec96718d917 (Debug, UBASAN, Clang 21.1.3-20250923) Build 27/12/2025

      Core was generated by `/test/MDEV-35915_v9_UBASAN_MD271225-mariadb-12.2.0-linux-x86_64-dbg/bin/mariadb'.
      Program terminated with signal SIGABRT, Aborted.
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
       
      [Current thread is 1 (LWP 3018542)]
      (gdb) bt
      #0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #1  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #2  __GI___pthread_kill (threadid=<optimized out>, signo=6)at ./nptl/pthread_kill.c:89
      #3  0x000064f68ea03dc0 in handle_fatal_signal (sig=<optimized out>)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/signal_handler.cc:298
      #4  <signal handler called>
      #5  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:44
      #6  __pthread_kill_internal (signo=6, threadid=<optimized out>)at ./nptl/pthread_kill.c:78
      #7  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)at ./nptl/pthread_kill.c:89
      #8  0x00007d1b09e4526e in __GI_raise (sig=sig@entry=6)at ../sysdeps/posix/raise.c:26
      #9  0x00007d1b09e288ff in __GI_abort () at ./stdlib/abort.c:79
      #10 0x00007d1b09e2881b in __assert_fail_base (fmt=0x7d1b09fd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x64f68d7baec0 <str> "share->tdc->ref_count", file=file@entry=0x64f68d7ba0a0 "/test/bb-12.2-nikita-global-tmp_dbg_san/sql/table_cache.cc", line=line@entry=986, function=function@entry=0x64f68d7baf00 <__PRETTY_FUNCTION__._Z17tdc_release_shareP11TABLE_SHARE> "void tdc_release_share(TABLE_SHARE *)")at ./assert/assert.c:94
      #11 0x00007d1b09e3b507 in __assert_fail (assertion=0x64f68d7baec0 <str> "share->tdc->ref_count", file=0x64f68d7ba0a0 "/test/bb-12.2-nikita-global-tmp_dbg_san/sql/table_cache.cc", line=986, function=0x64f68d7baf00 <__PRETTY_FUNCTION__._Z17tdc_release_shareP11TABLE_SHARE> "void tdc_release_share(TABLE_SHARE *)") at ./assert/assert.c:103
      #12 0x000064f68fecec42 in tdc_release_share (share=0x7b6b08cf4938)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/table_cache.cc:986
      #13 0x000064f68fec71ab in intern_close_table (table=0x7aab08c72898)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/table_cache.cc:231
      #14 0x000064f68ed61988 in close_thread_tables (thd=0x7bcb08d85218)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_base.cc:1019
      #15 0x000064f68ed7626b in Locked_tables_list::unlock_locked_tables (this=0x7bcb08d89428, thd=0x7bcb08d85218)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_base.cc:2752
      #16 0x000064f68fac505f in trans_begin (thd=thd@entry=0x7bcb08d85218, flags=0)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/transaction.cc:110
      #17 0x000064f68f27b52d in mysql_execute_command (thd=0x7bcb08d85218, is_called_from_prepared_stmt=<optimized out>)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_parse.cc:5487
      #18 0x000064f68f25a9a9 in mysql_parse (thd=thd@entry=0x7bcb08d85218, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x791a3453b7c0)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_parse.cc:7911
      #19 0x000064f68f254162 in dispatch_command (command=<optimized out>, thd=0x7bcb08d85218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_parse.cc:1898
      #20 0x000064f68f25cddb in do_command (thd=thd@entry=0x7bcb08d85218, blocking=<optimized out>)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_parse.cc:1437
      #21 0x000064f68fa613dd in do_handle_one_connection (connect=<optimized out>, connect@entry=0x799b08c25638, put_in_cache=<optimized out>)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_connect.cc:1414
      #22 0x000064f68fa60ee6 in handle_one_connection (arg=0x799b08c25638)at /test/bb-12.2-nikita-global-tmp_dbg_san/sql/sql_connect.cc:1326
      #23 0x000064f68e219a8b in asan_thread_start(void*) ()
      #24 0x00007d1b09e9ca94 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
      #25 0x00007d1b09f29c3c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
      

      No UBSAN/ASAN issues observed.

      Attachments

        Issue Links

          Activity

            People

              nikitamalyavin Nikita Malyavin
              Roel Roel Van de Paar
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.