Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-40320

use-of-uninitialized-value in dict_col_t::is_added() const

    XMLWordPrintable

Details

    • Can result in hang or crash
    • Q4/2026 Server Maintenance

    Description

      CS 10.11.19 9b6fdee3456df8e979f91ffdd727ba85fc491442 (Debug, MSAN, Clang 20.1.8-20250804) Build 08/07/2026

      # 2026-07-08T23:15:22 [3113145] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_msan/storage/innobase/include/dict0mem.h:605:5 in dict_col_t::is_added() const
      

      Stacktrace

       2026-07-08T23:15:22 [3113145] | ==3116777==WARNING: MemorySanitizer: use-of-uninitialized-value
      # 2026-07-08T23:15:22 [3113145] | 2026-07-08 23:09:33 26 [ERROR] InnoDB: Transaction was aborted due to Deadlock
      # 2026-07-08T23:15:22 [3113145] | 2026-07-08 23:09:35 43 [Warning] Aborted connection 43 to db: 'test' user: 'root' host: 'localhost' (KILLED)
      # 2026-07-08T23:15:22 [3113145] | 2026-07-08 23:09:37 48 [Warning] Aborted connection 48 to db: 'test' user: 'root' host: 'localhost' (KILLED)
      # 2026-07-08T23:15:22 [3113145] |     #0 0x5aec7325906a in dict_col_t::is_added() const /test/10.11_dbg_msan/storage/innobase/include/dict0mem.h:605:5
      # 2026-07-08T23:15:22 [3113145] |     #1 0x5aec7325906a in dict_table_get_nth_v_col(dict_table_t const*, unsigned long) /test/10.11_dbg_msan/storage/innobase/include/dict0dict.inl:339:2
      # 2026-07-08T23:15:22 [3113145] |     #2 0x5aec7326302f in build_template_field(row_prebuilt_t*, dict_index_t*, dict_index_t*, TABLE*, Field const*, unsigned long, unsigned long) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:7128:10
      # 2026-07-08T23:15:22 [3113145] |     #3 0x5aec732616fc in ha_innobase::build_template(bool) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:7571:4
      # 2026-07-08T23:15:22 [3113145] |     #4 0x5aec73292a85 in ha_innobase::check(THD*, st_ha_check_opt*) /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:15319:3
      # 2026-07-08T23:15:22 [3113145] |     #5 0x5aec71d91b39 in handler::ha_check(THD*, st_ha_check_opt*) /test/10.11_dbg_msan/sql/handler.cc:5178:7
      # 2026-07-08T23:15:22 [3113145] |     #6 0x5aec72c6e903 in mysql_admin_table(THD*, TABLE_LIST*, st_ha_check_opt*, st_mysql_const_lex_string const*, thr_lock_type, bool, bool, unsigned int, int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), int (handler::*)(THD*, st_ha_check_opt*), int (*)(THD*, TABLE_LIST*, st_ha_check_opt*), bool) /test/10.11_dbg_msan/sql/sql_admin.cc:918:21
      # 2026-07-08T23:15:22 [3113145] |     #7 0x5aec72c72ce5 in Sql_cmd_check_table::execute(THD*) /test/10.11_dbg_msan/sql/sql_admin.cc:1619:8
      # 2026-07-08T23:15:22 [3113145] |     #8 0x5aec7277c079 in mysql_execute_command(THD*, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:6199:26
      # 2026-07-08T23:15:22 [3113145] |     #9 0x5aec727706ef in mysql_parse(THD*, char*, unsigned int, Parser_state*) /test/10.11_dbg_msan/sql/sql_parse.cc:8219:18
      # 2026-07-08T23:15:22 [3113145] |     #10 0x5aec7276a126 in dispatch_command(enum_server_command, THD*, char*, unsigned int, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:1924:7
      # 2026-07-08T23:15:22 [3113145] |     #11 0x5aec727711ae in do_command(THD*, bool) /test/10.11_dbg_msan/sql/sql_parse.cc:1434:17
      # 2026-07-08T23:15:22 [3113145] |     #12 0x5aec72c3d22c in do_handle_one_connection(CONNECT*, bool) /test/10.11_dbg_msan/sql/sql_connect.cc:1482:11
      # 2026-07-08T23:15:22 [3113145] |     #13 0x5aec72c3cbb6 in handle_one_connection /test/10.11_dbg_msan/sql/sql_connect.cc:1394:5
      # 2026-07-08T23:15:22 [3113145] |     #14 0x77e05c69caa3 in start_thread nptl/pthread_create.c:447:8
      # 2026-07-08T23:15:22 [3113145] |     #15 0x77e05c729a63 in clone misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:100
      # 2026-07-08T23:15:22 [3113145] | 
      # 2026-07-08T23:15:22 [3113145] |   Member fields were destroyed
      # 2026-07-08T23:15:22 [3113145] |     #0 0x5aec71c9f6b1 in __sanitizer_dtor_callback_fields (/data/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg/bin/mariadbd+0xff86b1) (BuildId: 9ac4fa3f4478741e712ebd6016da11b676c29367)
      # 2026-07-08T23:15:22 [3113145] |     #1 0x5aec73687889 in dict_v_col_t::~dict_v_col_t() /test/10.11_dbg_msan/storage/innobase/include/dict0mem.h:735:14
      # 2026-07-08T23:15:22 [3113145] |     #2 0x5aec73687889 in dict_v_col_t::~dict_v_col_t() /test/10.11_dbg_msan/storage/innobase/include/dict0mem.h:733:8
      # 2026-07-08T23:15:22 [3113145] |     #3 0x5aec73687889 in ha_innobase_inplace_ctx::~ha_innobase_inplace_ctx() /test/10.11_dbg_msan/storage/innobase/handler/handler0alter.cc:1203:19
      # 2026-07-08T23:15:22 [3113145] | 
      # 2026-07-08T23:15:22 [3113145] | SUMMARY: MemorySanitizer: use-of-uninitialized-value /test/10.11_dbg_msan/storage/innobase/include/dict0mem.h:605:5 in dict_col_t::is_added() const
       
       
      # 2026-07-08T23:17:51 [3113145] | Thread 3 (Thread 3116777.3119761 (mariadbd)):
      # 2026-07-08T23:17:51 [3113145] | #0  0x0000000070000002 in syscall_traced ()
      # 2026-07-08T23:17:51 [3113145] | #1  0x000077e05d704018 in _raw_syscall () at /home/ubuntu/rr/src/preload/raw_syscall.S:120
      # 2026-07-08T23:17:51 [3113145] | #2  0x000077e05d6fd909 in traced_raw_syscall (call=0x77e0227fffa0) at /home/ubuntu/rr/src/preload/syscallbuf.c:379
      # 2026-07-08T23:17:51 [3113145] | #3  0x000077e05d7010bc in sys_futex (call=<optimized out>) at /home/ubuntu/rr/src/preload/syscallbuf.c:2085
      # 2026-07-08T23:17:51 [3113145] | #4  syscall_hook_internal (call=call@entry=0x77e0227fffa0) at /home/ubuntu/rr/src/preload/syscallbuf.c:4203
      # 2026-07-08T23:17:51 [3113145] | #5  0x000077e05d703da4 in syscall_hook (call=0x77e0227fffa0) at /home/ubuntu/rr/src/preload/syscallbuf.c:4387
      # 2026-07-08T23:17:51 [3113145] | #6  syscall_hook (call=0x77e0227fffa0) at /home/ubuntu/rr/src/preload/syscallbuf.c:4371
      # 2026-07-08T23:17:51 [3113145] | #7  0x000077e05d6fd323 in _syscall_hook_trampoline () at /home/ubuntu/rr/src/preload/syscall_hook.S:308
      # 2026-07-08T23:17:51 [3113145] | #8  0x000077e05d6fd38d in __morestack () at /home/ubuntu/rr/src/preload/syscall_hook.S:443
      # 2026-07-08T23:17:51 [3113145] | #9  0x000077e05d6fd47b in _syscall_hook_trampoline_c3_nop () at /home/ubuntu/rr/src/preload/syscall_hook.S:535
      # 2026-07-08T23:17:51 [3113145] | #10 0x00005aec71cfb2d5 in __msan::ReportUMR(__sanitizer::StackTrace*, unsigned int) ()
      # 2026-07-08T23:17:51 [3113145] | #11 0x00005aec71c8d9c6 in __msan::PrintWarningWithOrigin(unsigned long, unsigned long, unsigned int) ()
      # 2026-07-08T23:17:51 [3113145] | #12 0x00005aec71c8e2e6 in __msan_warning_with_origin_noreturn ()
      # 2026-07-08T23:17:51 [3113145] | #13 0x00005aec7325906b in dict_col_t::is_added (this=<optimized out>) at include/dict0mem.h:605
      # 2026-07-08T23:17:51 [3113145] | #14 dict_table_get_nth_v_col (table=<optimized out>, pos=pos@entry=0) at include/dict0dict.inl:339
      # 2026-07-08T23:17:51 [3113145] | #15 0x00005aec73263030 in build_template_field (prebuilt=0x7210001af488, clust_index=0x7150002c1f88, index=0x7150002c1f88, table=0x718000060c18, field=0x7110001eb070, i=7, v_no=0) at /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:7128
      # 2026-07-08T23:17:51 [3113145] | #16 0x00005aec732616fd in ha_innobase::build_template (this=this@entry=0x71d000168a30, whole_row=<optimized out>) at /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:7571
      # 2026-07-08T23:17:51 [3113145] | #17 0x00005aec7326f20d in ha_innobase::change_active_index (this=this@entry=0x71d000168a30, keynr=<optimized out>) at /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:9218
      # 2026-07-08T23:17:51 [3113145] | #18 0x00005aec73271c09 in ha_innobase::rnd_init (this=0x71d000168a30, scan=true) at /test/10.11_dbg_msan/storage/innobase/handler/ha_innodb.cc:9418
      # 2026-07-08T23:17:51 [3113145] | #19 0x00005aec71db2e23 in handler::ha_rnd_init (this=0x71d000168a30, scan=true) at /test/10.11_dbg_msan/sql/handler.h:3445
      # 2026-07-08T23:17:51 [3113145] | #20 0x00005aec71d898d9 in handler::ha_rnd_init_with_error (this=0x77e0229fd1b0, scan=144) at /test/10.11_dbg_msan/sql/handler.cc:3831
      # 2026-07-08T23:17:51 [3113145] | #21 0x00005aec7233b953 in init_read_record (info=<optimized out>, thd=0x72b0001ce018, table=0x718000060c18, select=0x7140000c0230, filesort=<optimized out>, use_record_cache=use_record_cache@entry=1, print_error=<optimized out>, disable_rr_cache=<optimized out>) at /test/10.11_dbg_msan/sql/records.cc:328
      # 2026-07-08T23:17:51 [3113145] | #22 0x00005aec7267d28f in mysql_delete (thd=<optimized out>, table_list=<optimized out>, conds=0x710000097830, order_list=<optimized out>, limit=<optimized out>, options=<optimized out>, result=<optimized out>) at /test/10.11_dbg_msan/sql/sql_delete.cc:808
      # 2026-07-08T23:17:51 [3113145] | #23 0x00005aec7278608e in mysql_execute_command (thd=<optimized out>, thd@entry=0x72b0001ce018, is_called_from_prepared_stmt=<optimized out>) at /test/10.11_dbg_msan/sql/sql_parse.cc:4960
      # 2026-07-08T23:17:51 [3113145] | #24 0x00005aec727706f0 in mysql_parse (thd=thd@entry=0x72b0001ce018, rawbuf=<optimized out>, length=<optimized out>, parser_state=parser_state@entry=0x77e0229ff440) at /test/10.11_dbg_msan/sql/sql_parse.cc:8219
      # 2026-07-08T23:17:51 [3113145] | #25 0x00005aec7276a127 in dispatch_command (command=COM_QUERY, thd=thd@entry=0x72b0001ce018, packet=packet@entry=0x72900018b019 " DELETE FROM t3 WHERE col_int = 830 OR col_int IS NULL  /* E_R Thread10 QNO 614 CON_ID 26 */ ", packet_length=packet_length@entry=93, blocking=true) at /test/10.11_dbg_msan/sql/sql_parse.cc:1924
      # 2026-07-08T23:17:51 [3113145] | #26 0x00005aec727711af in do_command (thd=thd@entry=0x72b0001ce018, blocking=<optimized out>) at /test/10.11_dbg_msan/sql/sql_parse.cc:1434
      # 2026-07-08T23:17:51 [3113145] | #27 0x00005aec72c3d22d in do_handle_one_connection (connect=<optimized out>, connect@entry=0x706000014118, put_in_cache=true) at /test/10.11_dbg_msan/sql/sql_connect.cc:1482
      # 2026-07-08T23:17:51 [3113145] | #28 0x00005aec72c3cbb7 in handle_one_connection (arg=0x706000014118) at /test/10.11_dbg_msan/sql/sql_connect.cc:1394
      # 2026-07-08T23:17:51 [3113145] | #29 0x000077e05c69caa4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:447
      # 2026-07-08T23:17:51 [3113145] | #30 0x000077e05c729a64 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:100
      

      RQG startup options

      # $RQG_HOME/rqg.pl \
      # --gendata=conf/mariadb/table_stress.zz \
      # --gendata_sql=conf/mariadb/table_stress.sql \
      # --grammar=conf/mariadb/table_stress_innodb.yy \
      # --mysqld=--transaction-isolation=SERIALIZABLE \
      # --validator=SelectStability \
      # --mysqld=--loose-innodb_lock_schedule_algorithm=fcfs \
      # --mysqld=--loose-idle_write_transaction_timeout=0 \
      # --mysqld=--loose-idle_transaction_timeout=0 \
      # --mysqld=--loose-idle_readonly_transaction_timeout=0 \
      # --mysqld=--connect_timeout=60 \
      # --mysqld=--interactive_timeout=28800 \
      # --mysqld=--slave_net_timeout=60 \
      # --mysqld=--net_read_timeout=30 \
      # --mysqld=--net_write_timeout=60 \
      # --mysqld=--loose-table_lock_wait_timeout=50 \
      # --mysqld=--wait_timeout=28800 \
      # --no_mask \
      # --queries=10000000 \
      # --seed=random \
      # --reporters=None \
      # --reporters=ErrorLog \
      # --reporters=Deadlock \
      # --validators=None \
      # --mysqld=--log_output=none \
      # --mysqld=--log_bin_trust_function_creators=1 \
      # --mysqld=--loose-debug_assert_on_not_freed_memory=0 \
      # --engine=InnoDB \
      # --restart_timeout=240 \
      # --mysqld=--plugin-load-add=file_key_management.so \
      # --mysqld=--loose-file-key-management-filename=$RQG_HOME/conf/mariadb/encryption_keys.txt \
      # --mysqld=--plugin-load-add=provider_lzo.so \
      # --mysqld=--plugin-load-add=provider_bzip2.so \
      # --mysqld=--plugin-load-add=provider_lzma.so \
      # --mysqld=--plugin-load-add=provider_snappy.so \
      # --mysqld=--plugin-load-add=provider_lz4.so \
      # --mysqld=--loose-innodb_compression_level=1 \
      # --duration=300 \
      # --mysqld=--loose-innodb_fatal_semaphore_wait_threshold=300 \
      # --mysqld=--lock-wait-timeout=15 \
      # --mysqld=--innodb-lock-wait-timeout=10 \
      # --mysqld=--loose-innodb_fast_shutdown=0 \
      # --mysqld=--sql_mode=STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION \
      # --mysqld=--loose-innodb_read_only_compressed=OFF \
      # --mysqld=--loose-innodb-sync-debug \
      # --mysqld=--innodb_stats_persistent=off \
      # --mysqld=--innodb_adaptive_hash_index=off \
      # --mysqld=--innodb_random_read_ahead=ON \
      # --mysqld=--innodb_read_ahead_threshold=0 \
      # --mysqld=--innodb_log_buffer_size=2M \
      # --mysqld=--log-bin \
      # --mysqld=--sync-binlog=1 \
      # --mysqld=--loose-innodb_evict_tables_on_commit_debug=on \
      # --threads=33 \
      # --rr=rr record --wait \
      # --mysqld=--innodb_undo_log_truncate=OFF \
      # --mysqld=--innodb_undo_tablespaces=3 \
      # --mysqld=--innodb_rollback_on_timeout=OFF \
      # --mysqld=--innodb_page_size=32K \
      # --mysqld=--innodb-buffer-pool-size=256M \
      # --vardir_type=fast \
      # --no_mask \
      # --batch \
      # --basedir1=/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg \
      # --basedir2=/Server_bin/MSAN_MD080726-mariadb-10.11.19-linux-x86_64-dbg \
      # --script_debug=_nix_ \
      # --major_runid=1783576491 \
      # --minor_runid=103
      

      RR trace is present on SDP :-
      /data/results/1783576491/TBR-2452

      Attachments

        Activity

          People

            thiru Thirunarayanan Balathandayuthapani
            saahil Saahil Alam
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:

              Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0d
                0d
                Logged:
                Time Spent - 0.15d
                0.15d

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.