Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-38784

Server crash in Item_func_nextval::val_int upon concurrent DML with triggers

    XMLWordPrintable

Details

    Description

      The test case is non-deterministic, run with --repeat=N. It fails for me easily on e.g. 11.4 debug and non-debug, usually within 5 attempts, but it takes much longer on 10.11; it can also vary on different machines and builds. Set --repeat to a sufficient number before giving up, the test is fast.

      It doesn't seem to match existing bugs for crashes in nextval: MDEV-38060 (here we don't re-create the table in which the sequence is used as default), MDEV-36362 (no partitioning here), MDEV-37906 (no insert DELAYED), MDEV-32262 (no replication).

      CREATE SEQUENCE s;
      		 
      CREATE TABLE t1 (a INT);
      		 
      INSERT INTO t1 VALUES (1);
      		 
       
      		 
      CREATE TABLE t2 (b INT, c INT DEFAULT(NEXTVAL(s)));
      		 
      CREATE TABLE t3 (d INT);
      		 
       
      		 
      --delimiter $
      		 
      CREATE PROCEDURE pr() BEGIN
      		 
        UPDATE t2 SET b = 2;
      		 
      END $
      		 
      CREATE TRIGGER tr1 BEFORE UPDATE ON t1 FOR EACH ROW BEGIN
      		 
        INSERT INTO t2 (b) VALUES (1);
      		 
        UPDATE t3 SET d = 2;
      		 
      END $
      		 
      CREATE TRIGGER tr2 AFTER UPDATE ON t3 FOR EACH ROW BEGIN
      		 
        CALL pr();
      		 
      END $
      		 
      --delimiter ;
      		 
       
      		 
      --connect (con1,localhost,root,,)
      		 
      --send
      		 
        EXECUTE IMMEDIATE "INSERT INTO t2 (b) VALUES (3)";
      		 
      --connection default
      		 
      --error 0,ER_BAD_FIELD_ERROR
      		 
      UPDATE t1 SET a = 4;
      		 
       
      		 
      --connection con1
      		 
      --reap
      		 
      --disconnect con1
      		 
      --connection default
      		 
      DROP TABLE t1, t2, t3;
      		 
      DROP PROCEDURE pr;
      		 
      DROP SEQUENCE s;

      Please don't add the test case to the regression suite, create a deterministic one instead.

      10.11 67fceadfa45b3f14921114544734455ecbdd480e

      		 
      #4  <signal handler called>
      		 
      #5  0x0000564644a6534e in Item_func_nextval::val_int (this=0x625001816b18) at /data/bld/10.11-asan-ubsan/sql/item_func.cc:7154
      		 
      #6  0x00005646447dab3d in Item::save_int_in_field (this=this@entry=0x625001816b18, field=field@entry=0x625001815a78, no_conversions=no_conversions@entry=false) at /data/bld/10.11-asan-ubsan/sql/item.cc:7116
      		 
      #7  0x0000564643fbccc8 in Type_handler_int_result::Item_save_in_field (this=<optimized out>, item=0x625001816b18, field=0x625001815a78, no_conversions=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_type.cc:4433
      		 
      #8  0x0000564644763d30 in Item::save_in_field (this=0x625001816b18, field=0x625001815a78, no_conversions=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/item.cc:7136
      		 
      #9  0x0000564643ab08d5 in TABLE::update_default_fields (this=this@entry=0x61900008a798, ignore_errors=ignore_errors@entry=false) at /data/bld/10.11-asan-ubsan/sql/table.cc:9256
      		 
      #10 0x00005646430b7651 in fill_record (thd=thd@entry=0x62c0000b0218, table_arg=table_arg@entry=0x61900008a798, fields=..., values=..., ignore_errors=ignore_errors@entry=false, update=update@entry=false) at /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9135
      		 
      #11 0x00005646430b7edf in fill_record_n_invoke_before_triggers (thd=thd@entry=0x62c0000b0218, table=table@entry=0x61900008a798, fields=..., values=..., ignore_errors=ignore_errors@entry=false, event=event@entry=TRG_EVENT_INSERT) at /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9279
      		 
      #12 0x000056464327eb5d in mysql_insert (thd=thd@entry=0x62c0000b0218, table_list=<optimized out>, fields=..., values_list=..., update_fields=..., update_values=..., duplic=<optimized out>, ignore=<optimized out>, result=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_insert.cc:1130
      		 
      #13 0x00005646434128d5 in mysql_execute_command (thd=0x62c0000b0218, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4662
      		 
      #14 0x0000564642ee1c46 in sp_instr_stmt::exec_core (this=0x625001a91e50, thd=<optimized out>, nextp=0x7fe661d567e0) at /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3950
      		 
      #15 0x0000564642f1b2bd in sp_lex_keeper::reset_lex_and_exec_core (this=this@entry=0x625001a91e98, thd=thd@entry=0x62c0000b0218, nextp=nextp@entry=0x7fe661d567e0, open_tables=open_tables@entry=false, instr=instr@entry=0x625001a91e50) at /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3661
      		 
      #16 0x0000564642f1e85a in sp_instr_stmt::execute (this=0x625001a91e50, thd=0x62c0000b0218, nextp=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sp_head.cc:3853
      		 
      #17 0x0000564642f2f5fd in sp_head::execute (this=this@entry=0x625001a90138, thd=thd@entry=0x62c0000b0218, merge_da_on_success=merge_da_on_success@entry=false) at /data/bld/10.11-asan-ubsan/sql/sp_head.cc:1464
      		 
      #18 0x0000564642f355f2 in sp_head::execute_trigger (this=this@entry=0x625001a90138, thd=thd@entry=0x62c0000b0218, db_name=db_name@entry=0x625001bcdd18, table_name=table_name@entry=0x625001bcdd28, grant_info=grant_info@entry=0x625001c32a38) at /data/bld/10.11-asan-ubsan/sql/sp_head.cc:1977
      		 
      #19 0x00005646439813fb in Table_triggers_list::process_triggers (this=this@entry=0x625001c32448, thd=thd@entry=0x62c0000b0218, event=event@entry=TRG_EVENT_UPDATE, time_type=time_type@entry=TRG_ACTION_BEFORE, old_row_is_record1=old_row_is_record1@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_trigger.cc:2496
      		 
      #20 0x00005646430b7f5b in fill_record_n_invoke_before_triggers (thd=thd@entry=0x62c0000b0218, table=table@entry=0x61900002e998, fields=..., values=..., ignore_errors=ignore_errors@entry=false, event=event@entry=TRG_EVENT_UPDATE) at /data/bld/10.11-asan-ubsan/sql/sql_base.cc:9285
      		 
      #21 0x0000564643a3a11b in mysql_update (thd=thd@entry=0x62c0000b0218, table_list=<optimized out>, fields=..., values=..., conds=conds@entry=0x0, order_num=order_num@entry=0, order=<optimized out>, limit=18446744073709551615, ignore=<optimized out>, found_return=<optimized out>, updated_return=<optimized out>) at /data/bld/10.11-asan-ubsan/sql/sql_update.cc:1067
      		 
      #22 0x00005646434104e5 in mysql_execute_command (thd=thd@entry=0x62c0000b0218, is_called_from_prepared_stmt=is_called_from_prepared_stmt@entry=false) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:4505
      		 
      #23 0x000056464342d6b4 in mysql_parse (thd=thd@entry=0x62c0000b0218, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x7fe661d58ab0) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:8223
      		 
      #24 0x0000564643436a61 in dispatch_command (command=command@entry=COM_QUERY, thd=thd@entry=0x62c0000b0218, packet=packet@entry=0x629000d70219 "UPDATE t1 SET a = 4", packet_length=packet_length@entry=19, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1924
      		 
      #25 0x0000564643443766 in do_command (thd=thd@entry=0x62c0000b0218, blocking=blocking@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_parse.cc:1434
      		 
      #26 0x0000564643c3fe88 in do_handle_one_connection (connect=<optimized out>, connect@entry=0x6080000039b8, put_in_cache=put_in_cache@entry=true) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1475
      		 
      #27 0x0000564643c40fe5 in handle_one_connection (arg=0x6080000039b8) at /data/bld/10.11-asan-ubsan/sql/sql_connect.cc:1387
      		 
      #28 0x00005646455c5a7d in pfs_spawn_thread (arg=0x617000005b98) at /data/bld/10.11-asan-ubsan/storage/perfschema/pfs.cc:2201
      		 
      #29 0x00007fe66bea81c4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
      		 
      #30 0x00007fe66bf2885c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

      Attachments

        Issue Links

          relates to

          Bug - A problem which impairs or prevents the functions of the product. MDEV-32262 InnoDB: Failing assertion: m_prebuilt->trx == thd_to_trx(m_user_thd) in ha_innobase::change_active_index

          • Major - Major loss of function.
          • Confirmed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-36362 MariaDB crashes when parsing fuzzer generated PARTITION

          • Critical - Crashes, loss of data, severe memory leak.
          • In Progress

          Bug - A problem which impairs or prevents the functions of the product. MDEV-37906 Server crash or UBSAN errors in Item_func_nextval::update_table upon INSERT DELAYED

          • Minor - Minor loss of function, or other problem where easy workaround is present.
          • Approved

          Bug - A problem which impairs or prevents the functions of the product. MDEV-38060 Server crashes upon replacing a sequence used as default by a table

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-38815 Server crashes in Item_func_nextval::val_int upon update on a view

          • Blocker - Blocks development and/or testing work, production could not run.
          • Open

          Activity

            People

              sanja Oleksandr Byelkin
              elenst Elena Stepanova
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.