[MDEV-40274] ALTER TABLE ADD VIRTUAL COLUMN after DISCARD TABLESPACE causes SIGSEGV in innobase_copy_frm_flags_from_table_share() - Jira

Details

Type: Bug
Status: Open (View Workflow)
Priority: Critical
Resolution: Unresolved
Affects Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0
Fix Version/s: 10.6, 10.11, 11.4, 11.8, 12.3, 13.0
Component/s: Storage Engine - InnoDB
Labels:

Bug Category:
Can result in hang or crash
Sprint:
Q4/2026 Server Maintenance

Description

--source include/have_innodb.inc

--source include/have_debug.inc

CREATE TABLE t5 (c1 INT) ENGINE=InnoDB;

SET SESSION debug_dbug='+d,row_ins_sec_index_entry_timeout';

--error ER_GET_ERRNO

ALTER TABLE t5 DISCARD TABLESPACE;

ALTER TABLE t5 ADD COLUMN cg16 INT AS(c1) VIRTUAL;

Leads to:

CS 10.11.19 d051e8663a8600cb899094498718859199a3ff0a (Debug, Clang 22.1.8-20260622) Build 23/06/2026
Core was generated by `/test/MD230626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --no-defaults --l'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00006023b8280dd6 in std::__atomic_base<unsigned int>::load (this=0x1c0, __m=std::memory_order_seq_cst)at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/atomic_base.h:505
505 return __atomic_load_n(&_M_i, int(__m));
[Current thread is 1 (LWP 2512971)]
(gdb) bt
#0 0x00006023b8280dd6 in std::__atomic_base<unsigned int>::load (this=0x1c0, __m=std::memory_order_seq_cst)at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/atomic_base.h:505
#1 Atomic_relaxed<unsigned int>::operator unsigned int (this=0x1c0)at /test/10.11_dbg/include/my_atomic_wrapper.h:48
#2 0x00006023b828069c in dict_table_t::stat_initialized (this=0x0)at include/dict0mem.h:2556
#3 0x00006023b824e00c in innobase_copy_frm_flags_from_table_share (innodb_table=0x0, table_share=0x7375382f0770)at /test/10.11_dbg/storage/innobase/handler/ha_innodb.cc:2987
#4 0x00006023b82aac6f in ha_innobase::commit_inplace_alter_table (this=0x6b743c02b908, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, commit=true)at /test/10.11_dbg/storage/innobase/handler/handler0alter.cc:11811
#5 0x00006023b7ed9a30 in handler::ha_commit_inplace_alter_table (this=0x6b743c02b908, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, commit=true)at /test/10.11_dbg/sql/handler.cc:5464
#6 0x00006023b7c4c5e1 in mysql_inplace_alter_table (thd=0x6b743c000d58, table_list=0x6b743c013590, table=0x6b743c007fd8, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, target_mdl_request=0x7375382f2170, ddl_log_state=0x7375382f0300, trigger_param=0x7375382f1d88, alter_ctx=0x7375382f1118, partial_alter=@0x7375382f02ee: false, start_alter_id=@0x7375382f02e0: 0, if_exists=false) at /test/10.11_dbg/sql/sql_table.cc:8190
#7 0x00006023b7c4522b in mysql_alter_table (thd=0x6b743c000d58, new_db=0x6b743c005908, new_name=0x6b743c005d68, create_info=0x7375382f31f0, table_list=0x6b743c013590, recreate_info=0x7375382f28d0, alter_info=0x7375382f3080, order_num=0, order=0x0, ignore=false, if_exists=false)at /test/10.11_dbg/sql/sql_table.cc:11462
#8 0x00006023b7cf56ed in Sql_cmd_alter_table::execute (this=0x6b743c013f20, thd=0x6b743c000d58) at /test/10.11_dbg/sql/sql_alter.cc:688
#9 0x00006023b7b464d3 in mysql_execute_command (thd=0x6b743c000d58, is_called_from_prepared_stmt=false)at /test/10.11_dbg/sql/sql_parse.cc:6199
#10 0x00006023b7b363e8 in mysql_parse (thd=0x6b743c000d58, rawbuf=0x6b743c013480 "ALTER TABLE t5 ADD COLUMN cg16 INT AS(c1) VIRTUAL", length=49, parser_state=0x7375382f4a20)at /test/10.11_dbg/sql/sql_parse.cc:8221
#11 0x00006023b7b33c3a in dispatch_command (command=COM_QUERY, thd=0x6b743c000d58, packet=0x6b743c00af09 "ALTER TABLE t5 ADD COLUMN cg16 INT AS(c1) VIRTUAL", packet_length=49, blocking=true) at /test/10.11_dbg/sql/sql_parse.cc:1924
#12 0x00006023b7b36e6a in do_command (thd=0x6b743c000d58, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1434
#13 0x00006023b7ceb4ae in do_handle_one_connection (connect=0x6023f8c50148, put_in_cache=true) at /test/10.11_dbg/sql/sql_connect.cc:1482
#14 0x00006023b7ceb295 in handle_one_connection (arg=0x6023f8d4a3e8)at /test/10.11_dbg/sql/sql_connect.cc:1394
#15 0x000073753c09caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#16 0x000073753c129c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Bug Detection Matrix
Rel o/d Build Commit UniqueID observed
CS 10.6 dbg 230626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 SIGSEGV\|dict_table_t::is_temporary\|innobase_copy_frm_flags_from_table_share\|ha_innobase::commit_inplace_alter_table\|handler::ha_commit_inplace_alter_table
CS 10.6 opt 220626 8eda90189340c31f7dfbae9ed870bfd8c0ad1776 No bug found
CS 10.11 dbg 230626 d051e8663a8600cb899094498718859199a3ff0a SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
CS 10.11 opt 220626 d051e8663a8600cb899094498718859199a3ff0a No bug found
CS 11.4 dbg 230626 bbd558c38616ce24bd2973486763c2a7c4db0969 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
CS 11.4 opt 220626 bbd558c38616ce24bd2973486763c2a7c4db0969 No bug found
CS 11.8 dbg 230626 eccdef627382b7b1f5338450ba328d16216c4fa2 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
CS 11.8 opt 220626 eccdef627382b7b1f5338450ba328d16216c4fa2 No bug found
CS 12.3 dbg 250626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
CS 12.3 opt 250626 c46441bc5f19f6b10dc1c3a2513d963c496e6578 No bug found
CS 13.0 dbg 290626 eb0f3282ae8d1f3762c86d682dba99c892498049 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
CS 13.0 opt 290626 eb0f3282ae8d1f3762c86d682dba99c892498049 No bug found
ES 10.6 dbg 230626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da SIGSEGV\|dict_table_t::is_temporary\|innobase_copy_frm_flags_from_table_share\|ha_innobase::commit_inplace_alter_table\|handler::ha_commit_inplace_alter_table
ES 10.6 opt 220626 e05a2b2ddaa1032a24924a6e1a12acd467abf4da No bug found
ES 11.4 dbg 230626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
ES 11.4 opt 220626 5b6db6d09008ba92cfc5a2ef980ab86badf70d12 No bug found
ES 11.8 dbg 230626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
ES 11.8 opt 220626 cc48b2b61be04be37daa2badcf254d96a26d2ba7 No bug found
ES 12.3 dbg 230626 a1d3628ea75207c85664946574ff803cbfc7c511 SIGSEGV\|std::__atomic_base<unsigned int>::load\|Atomic_relaxed<unsigned int>::operator unsigned int\|dict_table_t::stat_initialized\|innobase_copy_frm_flags_from_table_share
ES 12.3 opt 220626 a1d3628ea75207c85664946574ff803cbfc7c511 No bug found

Leads to:

CS 10.11.19 d051e8663a8600cb899094498718859199a3ff0a (Debug, Clang 22.1.8-20260622) Build 23/06/2026
Core was generated by `/test/MD230626-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd --no-defaults --l'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00006023b8280dd6 in std::__atomic_base<unsigned int>::load (this=0x1c0, __m=std::memory_order_seq_cst)at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/atomic_base.h:505
505 return __atomic_load_n(&_M_i, int(__m));
[Current thread is 1 (LWP 2512971)]
(gdb) bt
#0 0x00006023b8280dd6 in std::__atomic_base<unsigned int>::load (this=0x1c0, __m=std::memory_order_seq_cst)at /usr/lib/gcc/x86_64-linux-gnu/13/../../../../include/c++/13/bits/atomic_base.h:505
#1 Atomic_relaxed<unsigned int>::operator unsigned int (this=0x1c0)at /test/10.11_dbg/include/my_atomic_wrapper.h:48
#2 0x00006023b828069c in dict_table_t::stat_initialized (this=0x0)at include/dict0mem.h:2556
#3 0x00006023b824e00c in innobase_copy_frm_flags_from_table_share (innodb_table=0x0, table_share=0x7375382f0770)at /test/10.11_dbg/storage/innobase/handler/ha_innodb.cc:2987
#4 0x00006023b82aac6f in ha_innobase::commit_inplace_alter_table (this=0x6b743c02b908, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, commit=true)at /test/10.11_dbg/storage/innobase/handler/handler0alter.cc:11811
#5 0x00006023b7ed9a30 in handler::ha_commit_inplace_alter_table (this=0x6b743c02b908, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, commit=true)at /test/10.11_dbg/sql/handler.cc:5464
#6 0x00006023b7c4c5e1 in mysql_inplace_alter_table (thd=0x6b743c000d58, table_list=0x6b743c013590, table=0x6b743c007fd8, altered_table=0x7375382f0390, ha_alter_info=0x7375382f0048, target_mdl_request=0x7375382f2170, ddl_log_state=0x7375382f0300, trigger_param=0x7375382f1d88, alter_ctx=0x7375382f1118, partial_alter=@0x7375382f02ee: false, start_alter_id=@0x7375382f02e0: 0, if_exists=false) at /test/10.11_dbg/sql/sql_table.cc:8190
#7 0x00006023b7c4522b in mysql_alter_table (thd=0x6b743c000d58, new_db=0x6b743c005908, new_name=0x6b743c005d68, create_info=0x7375382f31f0, table_list=0x6b743c013590, recreate_info=0x7375382f28d0, alter_info=0x7375382f3080, order_num=0, order=0x0, ignore=false, if_exists=false)at /test/10.11_dbg/sql/sql_table.cc:11462
#8 0x00006023b7cf56ed in Sql_cmd_alter_table::execute (this=0x6b743c013f20, thd=0x6b743c000d58) at /test/10.11_dbg/sql/sql_alter.cc:688
#9 0x00006023b7b464d3 in mysql_execute_command (thd=0x6b743c000d58, is_called_from_prepared_stmt=false)at /test/10.11_dbg/sql/sql_parse.cc:6199
#10 0x00006023b7b363e8 in mysql_parse (thd=0x6b743c000d58, rawbuf=0x6b743c013480 "ALTER TABLE t5 ADD COLUMN cg16 INT AS(c1) VIRTUAL", length=49, parser_state=0x7375382f4a20)at /test/10.11_dbg/sql/sql_parse.cc:8221
#11 0x00006023b7b33c3a in dispatch_command (command=COM_QUERY, thd=0x6b743c000d58, packet=0x6b743c00af09 "ALTER TABLE t5 ADD COLUMN cg16 INT AS(c1) VIRTUAL", packet_length=49, blocking=true) at /test/10.11_dbg/sql/sql_parse.cc:1924
#12 0x00006023b7b36e6a in do_command (thd=0x6b743c000d58, blocking=true)at /test/10.11_dbg/sql/sql_parse.cc:1434
#13 0x00006023b7ceb4ae in do_handle_one_connection (connect=0x6023f8c50148, put_in_cache=true) at /test/10.11_dbg/sql/sql_connect.cc:1482
#14 0x00006023b7ceb295 in handle_one_connection (arg=0x6023f8d4a3e8)at /test/10.11_dbg/sql/sql_connect.cc:1394
#15 0x000073753c09caa4 in start_thread (arg=<optimized out>)at ./nptl/pthread_create.c:447
#16 0x000073753c129c6c in clone3 ()at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

ALTER TABLE ADD VIRTUAL COLUMN after DISCARD TABLESPACE causes SIGSEGV in innobase_copy_frm_flags_from_table_share()

Details

Description

Attachments

Activity

People

Dates

Time Tracking

Git Integration